Searchlight Cyber Finds Further Critical Vulnerabilities in ADOBE Experience Manager

Three new critical vulnerabilities include two paths to RCE and a pre-authentication XXE

BRISBANE, AUSTRALIA, July 29, 2025 /EINPresswire.com/ -- The Assetnote Security Research Team at Searchlight Cyber has published the details of three critical vulnerabilities it has discovered in Adobe Experience Manager (AEM) Forms.

The researchers disclosed to Adobe that Remote Code Execution (RCE) could be achieved in two different ways on the application, as well as an External Entity Injection (XXE) that does not require authentication to execute. The three new vulnerabilities follow three cross-site scripting vulnerabilities in AEM that the security researchers publicly disclosed earlier in July.

Many large enterprises use the AEM Content Management System to manage their websites, and the Forms function is used for dynamic form components that accept customer input. In total, the Assetnote Security Research Team disclosed three critical vulnerabilities in AEM Forms.

The exploitation of any of these in the wild could lead to the compromise of user interactions and data:

● Insecure deserialization vulnerability leading to RCE (CVE-2025-49533) - This vulnerability has a CVSS of 9.8. Adobe has provided mitigation advice for customers here.

● XXE within AEM Forms web services - This vulnerability is exploitable without authentication, making it particularly high risk for AEM Forms customers.

● Authentication bypass to RCE chain via Struts2 Devmode - Enabling Struts2 Devmode in the application can lead to command execution.

Shubham Shah, SVP of Research and Engineering at Searchlight Cyber commented: “The vulnerabilities we’ve disclosed in AEM Forms are not complex. Given the numerous bugs we’ve discovered and the lack of patches for the XXE and authentication bypass vulnerabilities leading to a RCE chain, we strongly recommend that customers using AEM Forms in standalone mode restrict access to this application to internal users and disable access from the external internet.”

Searchlight Cyber’s security research team continues to perform novel zero-day and N-day security research to ensure maximum coverage and care for its customers’ attack surfaces. All research is integrated into its Attack Surface Management platform, Assetnote, which continuously monitors, detects, and proves the exploitability of exposures before threat actors can use them.

About Searchlight Cyber:

Searchlight Cyber was founded in 2017 with a mission to stop threat actors from acting with impunity. Its External Cyber Risk Management Platform helps organizations to identify and protect themselves from emerging cybercriminal threats with Attack Surface Management and Threat Intelligence tools designed to separate the signal from the noise. It is used by some of the world’s largest enterprises, government and law enforcement agencies, and the Managed Security Service Providers at the forefront of protecting customers from external threats. Find out more at www.slcyber.io.

Sonia Awan
Outbloom Public Relations
soniaawan@outbloompr.net
Visit us on social media:
LinkedIn

Legal Disclaimer:

EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.