Adobe Experience Manager Forms: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• Critical 10.0
  CVE-2025-54253 Exploited Public exploit EPSS 81%

  Adobe Experience Manager | Incorrect Authorization (CWE-863)

  Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of …

  Adobe Adobe Experience Manager
  Aug 5, 2025

  KEV Oct 15, 2025
• High 8.6
  CVE-2025-54254 EPSS 54%

  Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

  Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive…

  Adobe Adobe Experience Manager
  Aug 5, 2025

Revision history

1. 2025-10-15 #2

   Aktive Ausnutzung gemeldet

2. 2025-08-05 #1

   Initiale Fassung

References

• Adobe Security Bulletin vom 2025-08-05
  https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html
• NIST Vulnerability Database vom 2025-08-05
  https://nvd.nist.gov/vuln/detail/CVE-2025-54253
• NIST Vulnerability Database vom 2025-08-05
  https://nvd.nist.gov/vuln/detail/CVE-2025-54254
• PoC vom 2025-08-05
  https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/
• CISA Known Exploited Vulnerability Catalog vom 2025-10-15
  https://www.cisa.gov/news-events/alerts/2025/10/15/cisa-adds-one-known-exploited-vulnerability-catalog