Advisory · CVE-2026-81995
Input validation flaw in AEM Forms JEE enables code execution
An improper input validation flaw in Adobe Experience Manager Forms JEE lets an attacker with high privileges execute arbitrary code. CVSS 9.1.
- Vendor
- Adobe
- Product
- AEM 6.5 Forms JEE
- Identifier / CWE
- CVE-2026-81995
CWE-20 - Action timing
- Immediate
Explain it like I’m five
A document scanner accepts any paper size, including one folded into a paper airplane. A privileged user folds the plane just right and it flies into the control room.
- 01High privileges
An attacker holds a high-privileged account on AEM Forms JEE.
- 02Crafted input
They submit input the application validates improperly.
- 03Validation bypass
The malformed input reaches code that trusts it.
- 04Code execution
Arbitrary code executes in the context of the current user with changed scope.
What happened
Adobe security bulletin APSB26-151 includes CVE-2026-81995, an improper input validation vulnerability (CWE-20) in Adobe Experience Manager Forms JEE. An attacker with high privileges can exploit it without user interaction to execute arbitrary code. AEM 6.5 Forms JEE up to and including 6.5.25 and AEM 6.5 LTS Forms JEE up to and including LTS SP2; fixed in 6.5.25 with hotfix AEMForms-6.5.0-0134 and in LTS SP3. NVD rates it CVSS 9.1 (v3.1).
What to do
- Apply hotfix AEMForms-6.5.0-0134 (or upgrade to AEM 6.5 LTS SP3).
- Review privileged account activity on Forms servers.
- Apply least-privilege review to Forms administrator roles.
Management note
High-privilege code execution rewards insider threats and stolen admin sessions. Same hotfix as the unauthenticated RCE in this bulletin, so fold it into the same change window.