EUVD-2025-20752CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged.
Analysis
Adobe Experience Manager versions 6.5.23.0 and earlier contain a deserialization of untrusted data vulnerability that allows unauthenticated remote code execution. No user interaction is required, making this a direct attack against enterprise content management infrastructure.
Technical Context
AEM deserializes untrusted Java objects from network requests without proper class filtering. Using known Java deserialization gadget chains, an attacker can achieve arbitrary code execution on the AEM server. The vulnerability requires no authentication and no user interaction, providing a direct remote attack path.
Affected Products
['Adobe Experience Manager <= 6.5.23.0', 'Adobe Experience Manager (Managed Services)']
Remediation
Apply the latest AEM security patch from Adobe. Implement Java deserialization filters (JEP 290). Restrict network access to AEM publishing and authoring instances. Monitor AEM error logs for deserialization exceptions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today