CVE-2025-54253 Adobe Experience Manager Forms Code Execution

Exploited in the wild Critical 10.0 Published 5 Aug 2025 Updated 26 Feb 2026

Attackers can bypass security mechanisms to execute arbitrary code in Adobe Experience Manager without user interaction.

Exploited in the wild: Since 15 Oct 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-54253?

CVE-2025-54253 is a critical missing authorization vulnerability in Adobe Experience Manager, published on 5 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

Weakness: CWE-863

Which versions are affected by CVE-2025-54253?

It affects 1 product.

Products include Adobe Experience Manager Forms.

How do I fix CVE-2025-54253?

No fix has been published for CVE-2025-54253 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 5 Nov 2025.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-54253 being exploited?

Yes. Attackers have exploited CVE-2025-54253 in the wild since at least 15 Oct 2025.

Public exploit code: 3 proofs of concept on GitHub.

Sources

Also known as GHSA-7mcc-8f7p-x6v7.