Adobe Experience Manager up to 6.5.23 config

Summaryinfo

A vulnerability was found in Adobe Experience Manager up to 6.5.23 and classified as critical. Impacted is an unknown function. The manipulation results in config. This vulnerability is known as CVE-2025-54253. It is possible to launch the attack remotely. Furthermore, an exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Adobe Experience Manager up to 6.5.23. It has been classified as critical. Affected is an unknown code. The manipulation with an unknown input leads to a config vulnerability. CWE is classifying the issue as CWE-16. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

The advisory is shared for download at helpx.adobe.com. This vulnerability is traded as CVE-2025-54253 since 07/17/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are unknown but an exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.004.

It is declared as attacked. This issue was added on 10/15/2025 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 11/05/2025:

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at EUVD (EUVD-2025-23647) and CERT Bund (WID-SEC-2025-1720). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Adobe Experience Manager Forms

Productinfo

Type

• Content Management System

Vendor

• Adobe

Name

• Experience Manager

Version

• 6.5.0
• 6.5.1
• 6.5.2
• 6.5.3
• 6.5.4
• 6.5.5
• 6.5.6
• 6.5.7
• 6.5.8
• 6.5.9
• 6.5.10
• 6.5.11
• 6.5.12
• 6.5.13
• 6.5.14
• 6.5.15
• 6.5.16
• 6.5.17
• 6.5.18
• 6.5.19
• 6.5.20
• 6.5.21
• 6.5.22
• 6.5.23

License

• commercial

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion