Adobe Experience Manager Forms vulnerabilities

8 CVEs affecting Adobe Experience Manager Forms, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-54254, published 2025-08-05.

More from Adobe.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-54253: Adobe Experience Manager Forms Code Execution Vulnerability, published 2025-08-05. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2025-10-15. EPSS: 88.3% chance of exploitation in the next 30 days. Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to…
• CVE-2025-54254, published 2025-08-05. High severity, CVSS 8.6. EPSS: 77.5% chance of exploitation in the next 30 days. Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An…
• CVE-2017-3067, published 2017-05-09. High severity, CVSS 7.5. EPSS: 4.8% chance of exploitation in the next 30 days. Adobe Experience Manager Forms versions 6.2, 6.1, 6.0 have an information disclosure vulnerability resulting from abuse of the pre-population service in AEM Forms.
• CVE-2020-9733, published 2020-09-10. High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days. An AEM java servlet in AEM versions 6.5.5.0 (and below) and 6.4.8.1 (and below) executes with the permissions of a high privileged service user. If exploited, this could lead to read-only access to…
• CVE-2020-9732, published 2020-09-10. Critical severity, CVSS 9.0. EPSS: 2.8% chance of exploitation in the next 30 days. The AEM Forms add-on for versions 6.5.5.0 (and below) and 6.4.8.2 (and below) are affected by a stored XSS vulnerability that allows users with 'Author' privileges to store malicious scripts in…
• CVE-2016-6934, published 2016-12-15. Medium severity, CVSS 6.1. EPSS: 2.6% chance of exploitation in the next 30 days. Adobe Experience Manager Forms versions 6.2 and earlier, LiveCycle 11.0.1, LiveCycle 10.0.4 have an input validation issue in the PMAdmin module that could be used in cross-site scripting attacks.
• CVE-2019-7129, published 2019-05-29. Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days. Adobe Experience Manager Forms versions 6.2, 6.3 and 6.4 have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
• CVE-2019-8089, published 2019-10-22. Medium severity, CVSS 6.1. EPSS: 1.5% chance of exploitation in the next 30 days. Adobe Experience Manager Forms versions 6.3-6.5 have a reflected cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.