This Adobe AEM flaw is as dangerous as they come, and it’s already being exploited

• Adobe has patched two critical AEM vulnerabilities, allowing code execution and file access without user interaction.
• CISA added CVE-2025-54253 and CVE-2025-54254 to KEV, confirming active exploitation.
• Agencies must install the patch by November 5; the private sector is strongly encouraged to follow suit due to the widespread risk

Adobe recently patched two vulnerabilities in its Experience Manager product, including a maximum severity vulnerability that could allow attackers execute arbitrary code.

While the company said it was “not aware” of existing exploits, it said it had seen proof-of-concept (PoC) exploits. Additionally, the US Cybersecurity and Infrastructure Security Agency (CISA) has added it to KEV (a known catalog of exploitable vulnerabilities), which means it is being used in attacks.