# CVE-2025-54253: Adobe Experience Manager - Information Disclosure

> Live exploitation tracking for CVE-2025-54253 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-54253

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Adobe Experience Manager
- **Weaknesses:** CWE-863 (Incorrect Authorization)
- **Tags:** enterprise_software

## Description

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code. Exploitation of this issue does not require user interaction and scope is changed.

## CrowdSec analysis

[CVE-2025-54253](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-54253) is a critical misconfiguration vulnerability in Adobe Experience Manager versions 6.5.23 and earlier that allows remote attackers to execute arbitrary code without any user interaction. By exploiting this flaw, attackers can bypass security mechanisms, potentially leading to full system compromise and unauthorized control over affected environments.

CrowdSec has been tracking this vulnerability and its exploits since 12th of November 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-54253 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit insecure deserialization by sending crafted payloads to the `/FormServer/servlet/GetDocumentServlet` endpoint, enabling remote code execution on vulnerable Adobe Experience Manager Forms instances. Initial reconnaissance often targets `/lc/libs/livecycle/core/content/login.html` to confirm the presence of the application.

## Timeline

- 2025-08-05: CVE Published. CVE-2025-54253 is published to NVD.
- 2025-10-15: CISA KEV. CVE-2025-54253 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-11-05: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-11-12: Rule Released. CrowdSec releases a rule to detect CVE-2025-54253 exploitation attempts against the CrowdSec Network.
- 2026-03-19: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-54253 for the first time.

## References

- https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54253
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-54253.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-54253) follows observed exploitation activity for CVE-2025-54253. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.