Organizations Warned of Exploited Adobe AEM Forms Vulnerability

According to CISA, a recent Adobe Experience Manager Forms (AEM Forms) vulnerability has been exploited in the wild, with CVE-2025-54253 (CVSS 10.0) added to the Known Exploited Vulnerabilities catalogue.

The flaw, described as a misconfiguration issue enabling arbitrary code execution, was patched in early August after a public PoC exploit appeared, and Adobe subsequently released patches for AEM Forms on Java Enterprise Edition (JEE) version 6.5.0-0108, which also addressed CVE-2025-54254 (CVSS 8.6), an XML External Entity restriction issue.

Shubham Shah and Adam Kues of Searchlight Cyber, who discovered the vulnerability, noted it involved authentication bypass combined with the admin UI’s Struts development mode being left enabled, allowing an attacker to craft a payload to execute OGNL expressions and bypass public sandbox restrictions to achieve remote code execution.

The advisory urged customers to update deployments as soon as possible, and federal agencies were instructed to identify vulnerable AEM Forms installations under Binding Operational Directive 22-01.