CISA: Maximum-severity Adobe flaw now exploited in attacks

CISA has warned that attackers are actively exploiting a maximum-severity vulnerability in Adobe Experience Manager to execute code on unpatched systems. Tracked as CVE-2025-54253, this critical security flaw stems from a misconfiguration weakness that affects Adobe Experience Manager (AEM) Forms on JEE versions 6.5.23 and earlier. Successful exploitation can allow unauthenticated threat actors to bypass security mechanisms and execute arbitrary code remotely in low-complexity attacks that don't require user interaction. The flaw was discovered by Adam Kues and Shubham Shah of Searchlight Cyber, who disclosed it to Adobe on April 28th, together with two other issues (CVE-2025-54254 and CVE-2025-49533). However, Adobe patched only the latter in April, leaving the other two unfixed for over 90 days, until after the two security researchers published a write-up on July 29th detailing how the vulnerabilities work and how they can be exploited. Adobe finally released security updates on August 9th to address the CVE-2025-54253 vulnerability, confirming that proof-of-concept exploit code was already publicly available. As Searchlight Cyber explained, CVE-2025-54253 is an authentication bypass that leads to remote code execution (RCE) via Struts DevMode. The researchers also advised admins to restrict Internet access to AEM Forms when deployed as a standalone application if they can't immediately patch the software. CISA has now added this vulnerability to its Known Exploited Vulne...