EUVD-2025-20752Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8, EPSS 47.0%. AEM is Adobe's enterprise CMS platform used by Fortune 500 companies for their public websites and digital experience platforms. These servers contain marketing content, customer data, and often integrate with internal systems. The 'unchanged' scope means the attacker operates within the AEM context. |
| Exploit ScenarioDerived | An attacker sends a crafted serialized Java object to an AEM endpoint. Deserialization triggers arbitrary code execution on the AEM server. The attacker accesses the content repository, extracts customer data and marketing assets, and pivots to connected internal systems through AEM's integration layer. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
Adobe Experience Manager versions 6.5.23.0 and earlier contain a deserialization of untrusted data vulnerability that allows unauthenticated remote code execution. No user interaction is required, making this a direct attack against enterprise content management infrastructure.
Earlier versions of this analysis (1)
Unauthenticated Java deserialization RCE in Adobe Experience Manager enables compromise of enterprise CMS infrastructure.
RemediationAI
Apply the latest AEM security patch from Adobe. Implement Java deserialization filters (JEP 290). Restrict network access to AEM publishing and authoring instances. Monitor AEM error logs for deserialization exceptions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AEM deserializes untrusted Java objects from network requests without proper class filtering. Using known Java deserialization gadget chains, an attacker can achieve arbitrary code execution on the AEM server. The vulnerability requires no authentication and no user interaction, providing a direct remote attack path.
Know when Experience Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged.
Executive ViewAI
CVE-2025-49533 presents critical security risk, a insecure deserialization vulnerability rated CVSS 9.8. Insecure deserialization could allow attackers to execute arbitrary code by providing crafted serialized data. With an EPSS score of 47%, exploitation is likely in exposed deployments. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict deserialization endpoints; (2) Implement integrity checks on serialized data; (3) Use type-safe alternatives.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Experience Manager
View allSitecore Experience Manager, Platform, and Commerce versions 9.0 through 10.4 contain a Zip Slip vulnerability that allo
Sitecore PowerShell Extensions through version 7.0 allows authenticated users to upload arbitrary files including ASPX w
Dispatcher before 4.1.5 in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0 does not properly implement a URL filter, wh
Sitecore Experience Manager/Platform through version 9.0 contains a deserialization vulnerability enabling code injectio
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 through 10.4.1 contain a hardcoded administr
The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows r
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Ex
Multiple Sitecore products allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remote
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) a
Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability. Rated critical severity (CVSS 9.8
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerabilit
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), S
GitHub PoC
Exploit-DB