Adobe Experience Manager - Information Disclosure (CVE-2025-54253)
Description
Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.
psychologyCrowdSec Analysis
CVE-2025-54253 is a critical misconfiguration vulnerability in Adobe Experience Manager versions 6.5.23 and earlier that allows remote attackers to execute arbitrary code without any user interaction. By exploiting this flaw, attackers can bypass security mechanisms, potentially leading to full system compromise and unauthorized control over affected environments.
CrowdSec has been tracking this vulnerability and its exploits since 12th of November 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-54253 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit insecure deserialization by sending crafted payloads to the /FormServer/servlet/GetDocumentServlet endpoint, enabling remote code execution on vulnerable Adobe Experience Manager Forms instances. Initial reconnaissance often targets /lc/libs/livecycle/core/content/login.html to confirm the presence of the application.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-08-05 |
| CISA KEV | 2025-10-15 |
| CISA Remediation Deadline | 2025-11-05 |
| Rule Released | 2025-11-12 |
| CrowdSec First Seen | 2026-03-19 |