Adobe issues emergency fixes for AEM Forms zero-days after PoCs released
Adobe released emergency updates for two zero-day flaws in Adobe Experience Manager (AEM) Forms on JEE after a PoC exploit chain was disclosed that can be used for unauthenticated, remote code execution on vulnerable instances. The flaws are tracked as CVE-2025-54253 and CVE-2025-54254: CVE-2025-54253: Misconfiguration allowing arbitrary code execution. Rated "Critical" with a CVSS score of 8.6. Misconfiguration allowing arbitrary code execution. Rated "Critical" with a CVSS score of 8.6. CVE