CVE-2025-54249: Adobe Experience Manager SSRF Vulnerability

CVE-2025-54249 Overview

Adobe Experience Manager (AEM) versions 6.5.23.0 and earlier contain a Server-Side Request Forgery (SSRF) vulnerability tracked as CVE-2025-54249. The flaw allows a low-privileged authenticated attacker to manipulate server-side HTTP requests issued by the AEM instance. Successful exploitation bypasses security controls and grants unauthorized read access to resources reachable from the server. The vulnerability is classified under [CWE-918] and impacts confidentiality without affecting integrity or availability. Adobe published guidance in security bulletin APSB25-90.

Critical Impact
An authenticated attacker with low privileges can coerce AEM into issuing arbitrary internal requests, exposing data on internal networks and adjacent services normally shielded from external clients.

Affected Products

Adobe Experience Manager 6.5.23.0 and earlier (on-premises)
Adobe Experience Manager 6.5 LTS (initial release and SP1)
Adobe Experience Manager as a Cloud Service (AEMaaCS)

Discovery Timeline

2025-09-09 - CVE-2025-54249 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54249

Vulnerability Analysis

CVE-2025-54249 is a Server-Side Request Forgery vulnerability in Adobe Experience Manager. The application accepts attacker-controlled input that influences the target of a server-side HTTP request. Because the request originates from the AEM server itself, it inherits the server's network position and can reach hosts, cloud metadata endpoints, or internal services otherwise unreachable to external users.

The issue requires authentication but only low privileges, which is common in AEM environments where content authors, contributors, and self-service portal users hold non-administrative accounts. Exploitation does not require user interaction. The impact is limited to unauthorized read access, aligning with the SSRF pattern where the attacker retrieves responses proxied through the vulnerable server.

An EPSS score of 1.941% (78th percentile) reflects a higher-than-average likelihood of exploitation attempts relative to the broader CVE population.

Root Cause

The root cause is insufficient validation of URL or host inputs before AEM issues an outbound request on the user's behalf. Without strict allow-listing of destinations and protocols, the request-issuing component can be redirected toward internal endpoints. This is the canonical [CWE-918] pattern.

Attack Vector

The attacker authenticates to AEM with any low-privileged account and submits a crafted request to a functional endpoint that fetches remote resources. By supplying an internal URL, cloud metadata address, or non-HTTP scheme, the attacker forces AEM to retrieve that resource and return its contents. Adobe's advisory characterizes the outcome as a security feature bypass enabling unauthorized read access. See the Adobe Security Advisory APSB25-90 for vendor-specific technical context.

No verified proof-of-concept code is publicly available for CVE-2025-54249.
Refer to Adobe Security Advisory APSB25-90 for vendor technical details.

Detection Methods for CVE-2025-54249

Indicators of Compromise

Outbound HTTP requests from AEM Java processes to RFC 1918 addresses, 169.254.169.254, or localhost that do not match documented integrations.
Unexpected requests to internal service ports (databases, admin consoles, cloud metadata) originating from the AEM host.
Repeated 4xx or redirect responses in AEM access logs tied to endpoints that accept a URL parameter.

Detection Strategies

Review AEM request.log and access.log for authenticated requests containing URL-shaped parameters targeting fetch, proxy, or import functionality.
Correlate AEM outbound network flows with the process identity to detect requests toward internal ranges or metadata endpoints.
Deploy egress filtering telemetry and alert when the AEM host initiates connections to non-approved internal destinations.

Monitoring Recommendations

Forward AEM application, dispatcher, and web server logs to a central analytics platform for authenticated-user behavioral baselining.
Instrument the AEM host to record outbound connection metadata (destination, port, process, user context).
Alert on any AEM-originated request to cloud instance metadata services or internal management interfaces.

How to Mitigate CVE-2025-54249

Immediate Actions Required

Upgrade Adobe Experience Manager to the fixed release identified in Adobe Security Advisory APSB25-90.
Audit AEM user accounts and revoke unused low-privileged access to reduce the population capable of authenticating for exploitation.
Restrict AEM outbound network egress at the firewall to the minimum set of hosts and ports required for operation.

Patch Information

Adobe addressed CVE-2025-54249 in the updates listed in bulletin APSB25-90, covering AEM 6.5 Service Pack releases beyond 6.5.23.0, AEM 6.5 LTS updates, and the AEM as a Cloud Service release train. Apply the vendor-recommended service pack or LTS update for the deployed version.

Workarounds

Block AEM egress to internal management ranges, 169.254.169.254, and non-required external destinations using host or network firewall rules.
Place AEM author instances behind a segmented network zone that cannot reach sensitive internal services.
Disable or restrict AEM features that accept user-supplied URLs for server-side fetching where operationally feasible.

bash

# Example egress restriction using iptables on the AEM host
iptables -A OUTPUT -m owner --uid-owner aem -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner aem -d 10.0.0.0/8 -p tcp \
  -m multiport --dports 22,3306,5432,6379,8080,8443 -j REJECT
iptables -A OUTPUT -m owner --uid-owner aem -d 127.0.0.0/8 \
  ! -p tcp --dport 4502:4503 -j REJECT