Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-54253

CVE-2025-54253CRITICAL

Adobe Experience Manager | Incorrect Authorization (CWE-863)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0   .8799   99.8   YES

AFFECTED
  Product                   Versions     Fixed
  Adobe Experience Manager  unspecified  —

TIMELINE
  Jul 17  Reserved by adobe
  Aug 5   Published (CNA: adobe)
  Oct 15  Added to CISA KEV, remediation due 2025-11-05

CWE-863 · CNA: adobe · CVSS v3.1 · 3 references · KEV due November 5, 2025

Description

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 17, 2025	Reserved	Reserved by adobe
August 5, 2025	Published	Published (CNA: adobe)
October 15, 2025	KEV ADDED	Added to CISA KEV, remediation due 2025-11-05

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Adobe	Adobe Experience Manager	—	—	—

Weaknesses

CWE-863

References (3)

https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html [vendor-advisory]
https://slcyber.io/assetnote-security-research-center/struts-devmode-in-2025-critical-pre-auth-vulnerabilities-in-adobe-experience-manager-forms/ [technical-description]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253 [government-resource]

Authoritative record: CVE-2025-54253 at cve.org

Vendors: adobe

Weaknesses: CWE-863

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-54253 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.