6 min read
By: RedLegg's Cyber Threat Intelligence Team
About:
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
Adobe Experience Manager Misconfiguration Remote Code Execution Vulnerability
CVSS Score: 10.0 (Critical)
Identifier: CVE-2025-54253
Exploit or POC: Yes – Proof-of-concept details have been published by researchers; Adobe reports no known in-the-wild exploitation
Update: CVE-2025-54253 – Adobe Security Advisory
Description: CVE-2025-54253 is a critical misconfiguration vulnerability in Adobe Experience Manager (AEM) Forms JEE, affecting version 6.5.23 and earlier. The vulnerability stems from a misconfigured developer mode that allows attackers to bypass authentication in the /adminui module and execute arbitrary code. Specifically, with Struts2 development mode enabled, attackers can send OGNL expressions via debug parameters in HTTP requests to execute remote code. Threat actors do not require user interaction to exploit, and the exploit bypasses system boundaries (scope changed).
Apply the update released in Adobe's latest security bulletin APSB25-82 immediately for AEM Forms JEE
Disable Struts2 development mode in production environments
Restrict network access to AEM admin interfaces, especially in non-development settings
Monitor logs for suspicious debug parameter use or OGNL-style payloads
Adobe Experience Manager Forms XXE (XML External Entity) Information Disclosure Vulnerability
CVSS Score: 8.6 (High)
Identifier: CVE-2025-54254
Exploit or POC: Yes – publicly available proof-of-concept released by researchers; Adobe reports no known in-the-wild exploitation
Update: CVE-2025-54254 – Adobe Security Advisory
Mitigation Recommendation:
Apply the AEM Forms patch released in Adobe Security Bulletin APSB25-82 immediately.
If patching is delayed, restrict external access to SOAP and AEM management endpoints.
Implement network segmentation and strict access control to AEM environments.
Monitor logs for anomalous XML payload activity and attempted access to sensitive files.
