CVE-2025-54247: Adobe Experience Manager · Improper Input Validation
Affects Adobe Experience ManagerSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 06:26 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 40% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 9 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Adobe Adobe Experience Manager | Affected
| Fixed in– |
AI-suggested
European organizations should implement the following specific mitigation steps: 1) Immediately inventory all Adobe Experience Manager instances and confirm versions; prioritize upgrading to versions later than 6.5.23.0 once Adobe releases a patch. 2) Until patches are available, restrict network access to AEM instances by implementing strict firewall rules and network segmentation to limit exposure to trusted internal users only. 3) Employ web application firewalls (WAFs) with custom rules to detect and block anomalous input patterns that could exploit input validation flaws. 4) Conduct thorough access reviews to minimize privileges assigned to users and service accounts interacting with AEM, reducing the attack surface. 5) Monitor logs and network traffic for unusual read access patterns or unauthorized data retrieval attempts. 6) Engage with Adobe security advisories and subscribe to threat intelligence feeds to receive timely updates on patches and exploit developments. 7) Consider deploying runtime application self-protection (RASP) solutions that can detect and block exploitation attempts in real time. These targeted mitigations go beyond generic advice by focusing on access control tightening, network isolation, and proactive detection tailored to the nature of this vulnerability.
Description
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access.