CVE-2025-54254: Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 70.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-05 · updated 2026-06-17
Weakness: CWE-611

Description

Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files on the local file system, scope is changed. Exploitation of this issue does not require user interaction.

Affected products

Adobe Experience Manager Forms: through 6.5.23.0

References

https://helpx.adobe.com/security/products/aem-forms/apsb25-82.html

Get alerted when CVE-2025-54254 or the next vulnerability affects your stack