EUVD-2026-84789
GHSA-m686-ggv2-x2m9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable RCE requiring pre-existing high privileges (PR:H) with no user interaction; full CIA impact and scope change beyond the vulnerable component justify S:C.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Arbitrary code execution is possible in Adobe Experience Manager 6.5 Forms JEE and AEM 6.5 LTS Forms JEE via an improper input validation weakness (CWE-20) that is reachable over the network with low attack complexity and no user interaction. Exploitation is gated by a mandatory prerequisite: the attacker must already hold a high-privilege account on the affected AEM Forms JEE instance (CVSS vector PR:H), so only administrative-level users, or an attacker who has first compromised such an account, can reach the vulnerable code path - the assessed risk is genuine but access-gated. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker who already holds high privileges (PR:H) on an Adobe Experience Manager Forms JEE instance - specifically AEM 6.5 Forms JEE or AEM 6.5 LTS Forms JEE. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but access-gated risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix described in Adobe security bulletin APSB26-151 (https://helpx.adobe.com/security/products/aem-forms/apsb26-151.html); patch availability is confirmed per the vendor advisory, but no exact fixed version number is present in the available data, so administrators should consult the bulletin directly to identify the correct build for their AEM 6.5 Forms JEE or 6.5 LTS Forms JEE deployment before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which AEM 6.5 Forms JEE and AEM 6.5 LTS Forms JEE instances are internet- or partner-facing and inventory every account holding elevated Forms/administrative privileges, then immediately restrict network reachability to the Forms JEE endpoints via firewall, VPN, or reverse-proxy allowlisting so only trusted administrative networks can reach them, and enforce phishing-resistant multi-factor authentication on all administrative accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Aem 6 5 Forms Jee
View allIncorrect authorization in Adobe Experience Manager Forms JEE (the 6.5 and 6.5 LTS branches) allows a remote, unauthenti
Server-side request forgery in Adobe Experience Manager (AEM) 6.5 Forms JEE and AEM 6.5 LTS Forms JEE lets an authentica
Server-side request forgery in Adobe Experience Manager Forms JEE lets an attacker who already holds high-privileged, ad
Stored cross-site scripting in Adobe Experience Manager 6.5 Forms JEE and 6.5 LTS Forms JEE lets a high-privileged, auth
Cross-site request forgery in Adobe Experience Manager Forms JEE (AEM 6.5 and 6.5 LTS) lets an attacker forge requests t
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today