CISA Warns Of Adobe Experience Manager Forms 0-Day Vulnerability Exploited In Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert concerning a critical code execution vulnerability in Adobe Experience Manager Forms. Organizations are urged to implement patches immediately to address this issue.

The vulnerability, identified as CVE-2025-54253 , affects the Java Enterprise Edition (JEE) version of Adobe Experience Manager Forms. This flaw allows attackers to execute arbitrary code on vulnerable systems.

First disclosed by Adobe in early October 2025, this vulnerability has been exploited in the wild, as noted in CISA’s Known Exploited Vulnerabilities Catalog.

Adobe Experience Manager Forms is widely used in enterprise environments for creating and managing digital forms. The vulnerability has a CVSS score of 9.8, indicating its severity, as it requires no user interaction or authentication to be triggered.

Exploitation of this flaw can result in attackers gaining full control over affected servers, potentially leading to data theft , ransomware deployment, or further network compromise.

Threat actors have been observed exploiting CVE-2025-54253 in targeted attacks. Security researchers have reported attempts against unpatched instances in cloud environments, where misconfigurations can increase the risk.

One incident involved a mid-sized financial services firm in Europe, where attackers used the flaw to deploy malware, causing a temporary service outage and data exfiltration.

CISA added the CVE to its catalog on October 15, 2025, requiring federal agencies to apply mitigations by November 14 or discontinue the use of the product. This directive aligns with Binding Operational Directive 22-01, which mandates a rapid response to actively exploited vulnerabilities in federal systems.

Private sector organizations, particularly those using Adobe’s web content management suite, are also at risk. Adobe has released patches for affected versions, including AEM Forms 6.5.13 and earlier. Users should apply updates promptly, implement multi-factor authentication, and segment networks to limit lateral movement.

For cloud deployments, adherence to BOD 22-01 guidance is essential, including regular vulnerability scanning. This incident highlights ongoing challenges in supply chain security, as Adobe products are integral to many digital ecosystems.

With confirmed exploitation, it is advised that organizations prioritize auditing their AEM deployments to mitigate evolving threats.

Based on reporting by Cyber Security News.