High priorityDisclosed

Advisory · CVE-2026-82000

SSRF in AEM Forms JEE enables privilege escalation

A server-side request forgery flaw in Adobe Experience Manager Forms JEE lets a low-privileged attacker reach internal resources and escalate privileges. CVSS 9.6.

Advisory published September 22, 2026Independent summary
Vendor
Adobe
Product
AEM 6.5 Forms JEE
Identifier / CWE
CVE-2026-82000
CWE-918
Action timing
Immediate
ELI5

Explain it like I’m five

A mailroom clerk will forward any package to any internal office you name. An attacker names the office that holds the master keys, and the clerk delivers the request there.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Low-privileged access

    An attacker holds a low-privileged account on AEM Forms JEE.

  2. 02Forged request

    They make the server issue requests to attacker-chosen destinations.

  3. 03Internal reach

    The requests reach internal resources from inside the trust boundary.

  4. 04Escalation

    The attacker gains elevated access to internal resources, with changed scope.

What happened

Adobe security bulletin APSB26-151 includes CVE-2026-82000, a server-side request forgery vulnerability (CWE-918) in Adobe Experience Manager Forms JEE. A low-privileged attacker can exploit it without user interaction to gain elevated access to internal resources. AEM 6.5 Forms JEE up to and including 6.5.25 and AEM 6.5 LTS Forms JEE up to and including LTS SP2; fixed in 6.5.25 with hotfix AEMForms-6.5.0-0134 and in LTS SP3. NVD rates it CVSS 9.6 (v3.1).

What to do

  1. Apply hotfix AEMForms-6.5.0-0134 (or upgrade to AEM 6.5 LTS SP3).
  2. Restrict outbound network access from Forms servers.
  3. Review logs for server-initiated requests to unexpected internal hosts.

Management note

Forms servers often sit close to document stores and internal services, which makes SSRF a pivot risk. Egress controls on the Forms tier are the lasting fix beyond the hotfix.