Server-Side Request Forgery Vulnerability in Adobe Experience Manager Forms JEE
CVE-2026-81999

8.7HIGH

Key Information:

Vendor

Adobe
Status
Aem 6.5 Forms Jee
Aem 6.5 Lts Forms Jee
Vendor
CVE Published:
22 September 2026

What is CVE-2026-81999?

Adobe Experience Manager Forms JEE is susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows attackers with elevated privileges to manipulate server requests and access internal resources, thereby increasing their level of access without requiring any user interaction. This change in scope can lead to significant security risks if not addressed promptly.

Affected Version(s)

AEM 6.5 Forms JEE 0 <= 6.5.25

AEM 6.5 LTS Forms JEE 0 <= 6.5 LTS SP2

AEM 6.5 Forms JEE 6.5.25 (AEMForms-6.5.0-0134 Hotfix)

References

https://helpx.adobe.com/security/products/aem-forms/apsb2...
vendor-advisory

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.