What is the CVSS score of CVE-2025-49533?

CVE-2025-49533 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 47.0%.

Which versions of Experience Manager are affected by CVE-2025-49533?

CVE-2025-49533 presents critical security risk, a insecure deserialization vulnerability rated CVSS 9.8.

Is there a public PoC exploit available for CVE-2025-49533?

Yes, a public proof-of-concept exploit is available for CVE-2025-49533. Prioritise patching immediately. EPSS: 47.0%.

How to fix or mitigate CVE-2025-49533?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Experience Manager CVE-2025-49533

EUVD-2025-20752 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-07-08 psirt@adobe.com

Deserialization RCE Adobe Experience Manager

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20752

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

CVE Published

Jul 08, 2025 - 22:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged.

AnalysisAI

Adobe Experience Manager versions 6.5.23.0 and earlier contain a deserialization of untrusted data vulnerability that allows unauthenticated remote code execution. No user interaction is required, making this a direct attack against enterprise content management infrastructure.

Technical ContextAI

AEM deserializes untrusted Java objects from network requests without proper class filtering. Using known Java deserialization gadget chains, an attacker can achieve arbitrary code execution on the AEM server. The vulnerability requires no authentication and no user interaction, providing a direct remote attack path.

RemediationAI

Apply the latest AEM security patch from Adobe. Implement Java deserialization filters (JEP 290). Restrict network access to AEM publishing and authoring instances. Monitor AEM error logs for deserialization exceptions.