Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side requests and bypass security controls allowing unauthorized read access.

Adobe Experience Manager (AEM) versions prior to 6.5.23.0 are affected by an XML External Entity (XXE) vulnerability. An attacker could exploit this vulnerability by sending a specially crafted XML request to the affected system, which could lead to unauthorized access to sensitive information or system compromise.

The version of Adobe Experience Manager installed on the remote host is prior or equal to 6.5.23. It is, therefore, might be affected by multiple vulnerabilities as referenced in the APSB25-90 advisory.

  - Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery     (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could     leverage this vulnerability to manipulate server-side requests and bypass security controls allowing     unauthorized read access. (CVE-2025-54249)

  - Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation     vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage     this vulnerability to bypass security measures and gain unauthorized read access. Scope is changed     (CVE-2025-54248)

  - Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Incorrect Authorization     vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage     this vulnerability to bypass security measures and gain unauthorized write access. (CVE-2025-54246)

  - Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation     vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage     this vulnerability to bypass security measures and gain unauthorized read access. (CVE-2025-54247)

  - Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation     vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage     this vulnerability to bypass security measures and gain unauthorized write access. (CVE-2025-54250)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
115070	Adobe Experience Manager (AEM) < 6.5.23.0 XML External Entity	Web App Scanning	Web Applications	medium
264629	Adobe Experience Manager < 6.5.23 (GRANITE-61551 Hotfix) / 6.5 LTS SP1 (GRANITE-61551 Hotfix) Multiple Security feature bypass (APSB25-90)	Nessus	Misc.	high

Detections

Analytics

CVE-2025-54249

medium

Tenable Plugins

medium

high