CISA Flags Adobe AEM Flaw with Perfect 10.0 Score — Already Under Active Attack

CISA has added the vulnerability CVE-2025-54253 to the Known Exploited Vulnerabilities catalog, with a CVSS score of 10.0, based on evidence of active exploitation. The flaw affects Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23.0 and earlier and was addressed in version 6.5.0-0108 released in early August 2025, alongside CVE-2025-54254 (CVSS 8.6).

The issue stems from the exposed /adminui/debug servlet, which evaluates user-supplied OGNL expressions as Java code without authentication, enabling arbitrary command execution with a single crafted HTTP request, according to FireCompass. There is currently no public information on real‑world exploitation, though Adobe’s advisory notes that CVE-2025-54253 and CVE-2025-54254 have publicly available proof‑of‑concepts. With active exploitation in view, U.S.

Federal Civilian Executive Branch agencies are being urged to apply fixes by 5 November 2025. According to CISA, the KEV catalog addition underscores the urgency of remediation and awareness of pre-auth risks.