CISA Known Exploited Vulnerability

CVE-2025-54253

Adobe · Experience Manager (AEM) Forms

Adobe Experience Manager Forms Code Execution Vulnerability

Date added 2025-10-15

BOD 22-01 due date 2025-11-05

CWE —

Ransomware Unknown

CISA description

Adobe Experience Manager Forms in JEE contains an unspecified vulnerability that allows for arbitrary code execution.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes & references

https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html
https://nvd.nist.gov/vuln/detail/CVE-2025-54253

Where this lands in 800-53

Vulnerability data triggers these controls during assessment and continuous monitoring.

RA-5 · Vulnerability Monitoring and Scanning
SI-2 · Flaw Remediation
CM-6 · Configuration Settings
SI-7 · Software, Firmware, and Information Integrity
CM-8 · System Component Inventory

External lookups

NVD · CVE-2025-54253
CVE.org · CVE-2025-54253
CISA KEV catalog (canonical)