CISA Emergency Alert: Critical Adobe AEM Flaw (CVE-2025-54253, CVSS 10.0) Under Active Exploitation

CISA has added a critical Adobe Experience Manager (AEM) vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in the wild. The flaw, tracked as CVE-2025-54253 with a CVSS score of 10.0, allows unauthenticated arbitrary code execution on vulnerable servers and affects AEM Forms versions 6.5.23 and earlier.

Adobe acknowledged that CVE-2025-54253 now has public proof-of-concept exploits circulating online, heightening the risk for organisations exposed to the internet. Security researchers say AEM instances are frequently internet-facing and used for content delivery and workflow management, making them a prime target for exploitation campaigns. In response, CISA has mandated that all Federal Civilian Executive Branch agencies remediate CVE-2025-54253 by 5 November 2025.