Vulnerability · Published Sep 9, 2025 · Assigned by adobe
CVE-2025-54249Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)
Medium 6.5
In plain English
A medium-severity server-side request forgery in Adobe Experience Manager from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Adobe Experience Manager | 0 – through 6.5.23.0 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N