CISA: Maximum-severity Adobe flaw now exploited in attacks

CISA warns that CVE-2025-54253, a critical authentication-bypass in Adobe Experience Manager (AEM) Forms (JEE ≤ 6.5.23), has been actively exploited to achieve remote code execution; proof-of-concept code was public and Adobe released patches on August 9 after delayed remediation. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog, triggering mandatory patching timelines for federal agencies and urging all organizations to apply mitigations or discontinue use if unable to patch.