VulnerabilityAnalyzed

CVE-2025-49533

Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker.

CRITICAL 9.8EPSS 52.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 52.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 52.94% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-502
Affected: adobe/experience manager
Source: psirt@adobe.com

References

https://helpx.adobe.com/security/products/aem-forms/apsb25-67.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.