CVE-2025-54254: Adobe Experience Manager Forms XXE allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityHigh CVSS (8.6) with network reachability, no authentication or user interaction, and a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is documented.

What it is

Adobe Experience Manager Forms versions 6.5.23 and earlier are affected by an XML External Entity (XXE) vulnerability (CWE-611) that permits arbitrary file system read. Because the scope is changed and no user interaction is needed, a remote unauthenticated attacker can reach sensitive local files, making this a serious exposure for internet-facing AEM Forms deployments.

Impact

An attacker gains read access to sensitive files on the local file system, potentially exposing credentials, configuration and other secrets. Confidentiality is rated high; there is no integrity or availability impact.

Attack surface

Reachable over the network via the CVSS vector AV:N with no privileges (PR:N) and no user interaction (UI:N), so an unauthenticated remote request that supplies crafted XML is sufficient. The scope change (S:C) indicates the vulnerable component can affect resources beyond its own security authority.

Exploitation

Not listed in CISA KEV and no public exploit references are provided, but EPSS is very high (0.77192, 99.5th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the Adobe security update for AEM Forms referenced in advisory APSB25-82; upgrade beyond 6.5.23.
• Disable external entity and DTD processing in all XML parsers used by AEM Forms.
• Restrict network access to AEM Forms endpoints and place them behind authentication or a WAF where feasible.
• Run the service with least-privilege file system permissions to limit what a successful XXE can read.
• Monitor the vendor advisory for updated fixed versions and re-check exposure.

Detection

• Inspect XML request bodies to AEM Forms endpoints for DOCTYPE declarations, ENTITY definitions or external SYSTEM/PUBLIC references.
• Alert on outbound network connections from the AEM Forms host to unexpected internal or external hosts, which may indicate entity resolution.
• Monitor file access and read events by the AEM Forms process for sensitive paths outside expected application directories.
• Review web and application logs for anomalous XML parsing errors or requests to XML-processing endpoints from unauthenticated clients.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.