CVE-2025-54253: Adobe Experience Manager Forms Code Execution Vulnerability

EPSS trend

Probability

88.26%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

+0.27 pp

From 87.99% on 19-09-2026

19-09-202619-10-2026

EPSS score

88.26%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 15-10-2025
Federal due date: 05-11-2025

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. helpx.adobe.com/security/products/aem-forms/apsb25-82.html nvd.nist.gov/vuln/detail/CVE-2025-54253

Public exploits

1 found

referenceUnverified
Exploit Reference (slcyber.io)
Maturity: unknown

References

3 links

helpx.adobe.com/security/products/aem-forms/apsb25-82.htmlVendor Advisory
slcyber.io/assetnote-security-research-center/…Technical DescriptionExploitThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253Government ResourceThird Party AdvisoryUS Government Resource

Related vulnerabilities

CVE-2016-6934adobeexperience_manager_forms+12.60%9y ago15-12-2016 06:31Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks.CVE-2025-54254adobeadobe experience manager+177.46%1y ago05-08-2025 16:53Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope is changed. Exploitation of this issue does not require user interaction.CVE-2020-9733adobeexperience_manager+13.75%6y ago10-09-2020 16:34An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited, this could lead to read-only access to sensitive data in an AEM repository.CVE-2020-9732adobeexperience_manager+12.81%6y ago10-09-2020 16:35The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in fields associated with the Sites component. These scripts may be executed in a victim’s browser when they open the page containing the vulnerable field.CVE-2017-3067adobeexperience_manager_forms4.79%9y ago09-05-2017 16:00Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Forms.CVE-2019-7129adobeadobe experience manager forms+11.63%7y ago29-05-2019 17:47Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

All vulnerabilities inadobe experience manager experience_manager_forms

CVE-2025-54253: Adobe Experience Manager Forms Code Execution Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References