Act nowDisclosed

Advisory · CVE-2026-75745

Incorrect authorization in AEM Forms JEE enables unauthenticated code execution

An incorrect authorization flaw in Adobe Experience Manager Forms JEE lets an unauthenticated attacker execute arbitrary code with changed scope. CVSS 10.0.

Advisory published September 22, 2026Independent summary
Vendor
Adobe
Product
AEM 6.5 Forms JEE
Identifier / CWE
CVE-2026-75745
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

A forms office has a VIP counter with no guard, just a sign. Anyone who walks past the sign gets served at the VIP counter with full staff privileges.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01No credentials

    An unauthenticated attacker reaches the AEM Forms JEE instance.

  2. 02Authorization gap

    An incorrectly enforced authorization check grants access it should deny.

  3. 03Code execution

    The attacker executes arbitrary code in the context of the current user with changed scope.

  4. 04Impact

    Full compromise of the Forms server; no user interaction required.

What happened

Adobe security bulletin APSB26-151 addresses CVE-2026-75745, an incorrect authorization vulnerability (CWE-863) in Adobe Experience Manager Forms JEE. An unauthenticated attacker can exploit it without user interaction to execute arbitrary code. AEM 6.5 Forms JEE up to and including 6.5.25 and AEM 6.5 LTS Forms JEE up to and including LTS SP2; fixed in 6.5.25 with hotfix AEMForms-6.5.0-0134 and in LTS SP3. NVD rates it CVSS 10.0 (v3.1).

What to do

  1. Apply hotfix AEMForms-6.5.0-0134 (or upgrade to AEM 6.5 LTS SP3) immediately.
  2. Restrict network access to Forms servers to trusted administrators while patching.
  3. Review server logs for unauthenticated requests that reached privileged functionality.

Management note

Unauthenticated RCE on a forms platform that processes submitted documents is a straight path to document theft and server takeover. This is the act-now item in the AEM bulletin.