Critical Adobe AEM Forms JEE Vulnerability (CVE-2025-54253) Under Active Exploitation: CISA Alerts, Patch Now

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding a critical vulnerability in Adobe Experience Manager (AEM) Forms. This flaw, cataloged as CVE-2024-20767 and assigned a perfect CVSS score of 10.0, enables unauthenticated remote code execution (RCE) on affected systems. The vulnerability is actively being exploited in the wild, with public proof-of-concept (PoC) code available and multiple threat intelligence sources confirming ongoing attacks. The flaw resides in the AEM Forms JEE component, specifically within the /adminui/debug servlet, which improperly evaluates user-supplied OGNL (Object-Graph Navigation Language) expressions as Java code without authentication or input validation. This report provides a comprehensive technical analysis, threat actor profile, exploitation details, victimology, and actionable mitigation guidance for organizations using Adobe AEM Forms.

Threat Actor Profile

Current exploitation of CVE-2024-20767 is opportunistic and widespread, with no single advanced persistent threat (APT) group attributed as of this writing. The attack surface is highly attractive to both financially motivated cybercriminals and state-sponsored actors due to the prevalence of Adobe AEM in enterprise and government environments. Observed tactics, techniques, and procedures (TTPs) align with those used by ransomware operators, initial access brokers, and web shell deployers. The availability of public PoC code has lowered the barrier to entry, enabling less sophisticated actors to exploit the flaw. Threat intelligence from FireCompass and The Hacker News indicates that exploitation is being automated and incorporated into mass scanning campaigns, targeting internet-exposed instances of AEM Forms JEE. The lack of authentication required for exploitation makes this vulnerability particularly attractive for actors seeking rapid lateral movement or initial foothold in target networks.

Technical Analysis of Malware/TTPs

The vulnerability in Adobe AEM Forms JEE is a classic example of an OGNL injection flaw. The /adminui/debug servlet is designed to facilitate debugging but fails to properly sanitize or authenticate user input. Attackers can craft HTTP POST or GET requests containing malicious OGNL expressions, which the servlet evaluates as Java code within the application context. This enables arbitrary command execution with the privileges of the AEM application user, often resulting in full system compromise.

Technical analysis of observed attacks reveals the following TTPs: adversaries scan for internet-facing AEM Forms JEE instances, send crafted requests to the vulnerable endpoint, and execute payloads that establish reverse shells, download additional malware, or create new administrative users. In several cases, attackers have deployed web shells for persistent access, exfiltrated sensitive data, and attempted lateral movement within the victim’s network. The exploitation chain is typically single-stage, requiring only network access to the vulnerable servlet and no prior authentication.

Indicators of compromise (IOCs) include anomalous HTTP requests to /adminui/debug, unexpected child processes spawned by the AEM application, and outbound connections to known command-and-control (C2) infrastructure. MITRE ATT&CK techniques observed in these campaigns include T1190 (Exploit Public-Facing Application) and T1059 (Command and Scripting Interpreter).

Exploitation in the Wild

Exploitation of CVE-2024-20767 is confirmed and ongoing. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch by the specified deadline. Security researchers at FireCompass and The Hacker News have observed mass scanning and exploitation attempts originating from multiple geographies. Attackers are leveraging public PoC code, which is widely available on platforms such as GitHub and exploit databases.

Victims have reported unauthorized access, web shell deployment, and in some cases, data exfiltration. The attack surface is significant, as many organizations expose AEM Forms JEE instances to the internet for business operations. The lack of authentication on the vulnerable endpoint means that any internet user can attempt exploitation, dramatically increasing the risk profile.

Victimology and Targeting

Victims of this campaign include large enterprises, government agencies, and organizations in regulated industries such as finance, healthcare, and critical infrastructure. Adobe AEM is widely used for content management and digital experience delivery, making it a high-value target for attackers seeking access to sensitive data or privileged network positions. Analysis of Shodan and Censys data indicates that hundreds of potentially vulnerable AEM Forms JEE instances are exposed to the public internet, with concentrations in North America, Europe, and Asia-Pacific.

Targeting appears to be indiscriminate at this stage, with attackers focusing on mass exploitation rather than specific organizations. However, the criticality of the flaw and the potential for privilege escalation and lateral movement mean that high-profile organizations are at elevated risk of follow-on attacks, including ransomware deployment and data theft.

Mitigation and Countermeasures

Immediate action is required to mitigate the risk posed by CVE-2024-20767. Organizations should upgrade to AEM Forms JEE version 6.5.0-0108 or later, as released in Adobe Security Bulletin APSB24-82. If immediate patching is not feasible, network-level controls should be implemented to restrict access to the /adminui/debug servlet, ideally limiting it to trusted administrative networks only. Web application firewalls (WAFs) should be configured to detect and block suspicious OGNL payloads targeting this endpoint.

Security teams must review application and web server logs for evidence of exploitation attempts, such as anomalous requests to /adminui/debug and unexpected process creation events. Any signs of compromise should trigger a full incident response, including forensic analysis, credential resets, and network segmentation to contain potential lateral movement.

Organizations are strongly advised to inventory all Adobe AEM Forms JEE deployments, prioritize patching of internet-exposed instances, and monitor for new advisories from Adobe and CISA. Regular vulnerability scanning and penetration testing should be conducted to identify and remediate similar misconfigurations in other web applications.

References

CISA KEV Catalog Entry for CVE-2024-20767, NVD Entry for CVE-2024-20767, Adobe Security Bulletin APSB24-82, The Hacker News: CISA Flags Adobe AEM Flaw with Perfect 10.0 Score — Already Under Active Attack, FireCompass Analysis.

About Rescana

Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to continuously monitor, assess, and mitigate cyber risks across their digital supply chain. Our advanced threat intelligence and automation capabilities empower security teams to proactively identify vulnerabilities, prioritize remediation, and ensure compliance with regulatory requirements. For more information about how Rescana can help strengthen your organization’s cyber resilience, we are happy to answer questions at ops@rescana.com.