Adobe Experience Manager - XML Injection (CVE-2025-54251)

CVE-2025-54251 is an XML Injection vulnerability in Adobe Experience Manager versions 6.5.23.0 and earlier, which could allow low-privileged attackers to bypass security features and manipulate XML queries. Exploiting this flaw may enable unauthorized users to gain limited write access, potentially leading to unauthorized data modifications within the application.

CrowdSec has been tracking this vulnerability and its exploits since 15th of October 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2025-54251 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-54251 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-54251 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers exploit this vulnerability by sending crafted multipart POST requests to the /crx/packmgr/service/exec.json endpoint, attempting to upload ZIP files containing malicious XML payloads for XML injection.