U.S. CISA adds Adobe Experience Manager Forms flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Adobe Experience Manager Forms flaw to its Known Exploited Vulnerabilities catalog, tracked as CVE-2025-54253 (CVSS 10.0). The vulnerability is a misconfiguration issue in Adobe Experience Manager Forms that could allow arbitrary code execution and affects AEM Forms versions 6.5.23 and earlier; exploitation does not require user interaction.

Adobe addressed the flaw in August 2025, and the entry notes that private organisations should review the KEV catalog and address the vulnerabilities. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, CISA orders federal agencies to fix the vulnerabilities by 5 November 2025. The article also highlights that FCEB agencies must comply and that organisations should consider the catalog when protecting their networks.