CVE-2025-54247: Adobe Experience Manager Auth Bypass Flaw

CVE-2025-54247 Overview

Adobe Experience Manager (AEM) versions 6.5.23.0 and earlier contain an Improper Input Validation vulnerability [CWE-20] that enables a security feature bypass. A low-privileged authenticated attacker can leverage the flaw over the network to bypass access controls and obtain unauthorized read access to protected content. The issue affects both on-premises AEM 6.5 LTS deployments and AEM Cloud Service instances. Adobe addressed the vulnerability in Security Bulletin APSB25-90.

Critical Impact
A low-privileged network attacker can bypass security controls in Adobe Experience Manager to read protected data without user interaction.

Affected Products

Adobe Experience Manager 6.5.23.0 and earlier (on-premises)
Adobe Experience Manager 6.5 LTS (including SP1)
Adobe Experience Manager Cloud Service (affected releases)

Discovery Timeline

2025-09-09 - CVE-2025-54247 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54247

Vulnerability Analysis

The vulnerability stems from improper validation of user-supplied input within Adobe Experience Manager. AEM fails to correctly enforce security constraints on inbound requests, allowing an authenticated attacker with low privileges to bypass access checks. The result is unauthorized read access to resources that should remain restricted based on the caller's role. Confidentiality is directly impacted, while integrity and availability are not affected according to the published CVSS vector.

The flaw is exploitable across the network with low attack complexity and requires no user interaction. Because AEM commonly hosts marketing sites, digital assets, and internal editorial workflows, exposed instances can leak draft content, asset metadata, or configuration data intended for restricted authoring groups.

Root Cause

The underlying weakness is classified as CWE-20 (Improper Input Validation). AEM does not sufficiently validate request parameters or resource identifiers before evaluating authorization for the requested action. This gap allows a request path that circumvents the intended security feature and reaches protected resources.

Attack Vector

Exploitation requires network access to an AEM author or publish instance and a valid low-privileged account, such as a standard content contributor. The attacker issues crafted HTTP requests to AEM endpoints that mishandle input validation. Because no user interaction is required, exploitation can be scripted against exposed instances. Adobe has not reported in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No public proof-of-concept code is available for this issue. Refer to the Adobe Security Bulletin APSB25-90 for vendor guidance.

Detection Methods for CVE-2025-54247

Indicators of Compromise

Unexpected HTTP 200 responses to authenticated requests from low-privileged users targeting /content/, /conf/, or /etc/ paths that should return 403 or 404.
Repeated requests from a single authenticated session enumerating resource paths, selectors, or suffixes with unusual parameter combinations.
Access log entries showing content or asset retrieval by user accounts that do not belong to the corresponding permission group.

Detection Strategies

Review AEM request.log and access.log for authenticated sessions accessing resources outside their assigned group scope.
Correlate Sling and Dispatcher logs to identify requests that bypass the Dispatcher filter but still succeed against the AEM instance.
Baseline normal content retrieval patterns per author role and alert on deviations, particularly bulk read activity.

Monitoring Recommendations

Forward AEM request, access, and error logs to a centralized SIEM for correlation with identity and network telemetry.
Monitor authentication events for accounts issuing high volumes of requests to protected repositories.
Track outbound data transfers from AEM publish nodes to identify potential exfiltration following unauthorized reads.

How to Mitigate CVE-2025-54247

Immediate Actions Required

Inventory all AEM 6.5 and AEM Cloud Service instances and confirm the running version against Adobe's fixed builds.
Apply the security update referenced in Adobe Security Bulletin APSB25-90 as soon as change windows permit.
Audit low-privileged AEM accounts and disable or rotate credentials for any that are unused or over-provisioned.
Restrict network exposure of AEM author instances to trusted networks or VPN access only.

Patch Information

Adobe released fixed versions for both AEM 6.5 and AEM Cloud Service. Administrators should install the patched service pack or cumulative fix pack referenced in Adobe Security Bulletin APSB25-90 and validate the deployed version after installation.

Workarounds

Enforce strict Dispatcher filter rules to deny unexpected selectors, extensions, and suffixes on protected paths.
Apply least-privilege ACLs in the JCR repository so that content contributor groups cannot read outside their assigned branches.
Place a web application firewall in front of AEM to inspect and rate-limit authenticated requests to sensitive endpoints.

bash

# Example Dispatcher filter hardening (excerpt from filters.any)
# Deny direct access to sensitive paths and restrict allowed extensions
/0100 { /type "deny" /url "*" }
/0101 { /type "allow" /extension '(css|gif|ico|js|png|svg|jpg|jpeg|html|json)' /path "/content/*" }
/0102 { /type "deny" /path "/conf/*" }
/0103 { /type "deny" /path "/etc/*" }
/0104 { /type "deny" /path "/system/*" }