CVE-2025-54253

An attacker can remotely, without needing an account or user interaction, exploit the system's misconfiguration to bypass security mechanisms. Successful exploitation results in a scope change, meaning the impact of the attack may extend beyond the directly vulnerable component. This allows for arbitrary code execution on the server side with potentially broad privileges.

An attacker can gain full control over the vulnerable server through remote code execution (RCE), which threatens the confidentiality, integrity, and availability of the system and data stored within it.

Apply patches available from the vendor immediately according to Adobe security bulletin APSB25-82 (https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html). Due to active exploitation in the production environment, the update should be performed as a priority.

Adobe Experience Manager Forms in versions 6.5.23 and earlier.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.