EUVD-2026-84792
GHSA-cwmg-h2cg-fq6p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable authorization bypass leading to RCE with no user interaction; S:C and full C/I/A per vendor, though 'current-user context' makes the impact ceiling vendor-dependent.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Incorrect authorization in Adobe Experience Manager Forms JEE (the 6.5 and 6.5 LTS branches) allows a remote, unauthenticated attacker to bypass intended access controls and execute arbitrary code in the context of the running AEM service account, with no user interaction required. The scope-change (S:C) rating and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H produce a maximum 10.0 base score, reflecting that successful exploitation can affect resources beyond the vulnerable component itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions per the CVSS vector - remote unauthenticated exploitation (AV:N/PR:N) against AEM 6.5 Forms JEE (including the 6.5 LTS Forms JEE build) with no user interaction (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix published in Adobe's security bulletin APSB26-151 (https://helpx.adobe.com/security/products/aem-forms/apsb26-151.html) - patch available per vendor advisory; the exact fixed build/version identifiers were not specified in the available input data, so confirm the correct hotfix or cumulative update for your AEM 6.5 or 6.5 LTS Forms JEE deployment directly from that advisory and validate the deployed build after installation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
No vendor-released patch identified at time of analysis for CVE-2026-75745 affecting Adobe Experience Manager Forms JEE 6.5 and 6.5 LTS. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Aem 6 5 Forms Jee
View allServer-side request forgery in Adobe Experience Manager (AEM) 6.5 Forms JEE and AEM 6.5 LTS Forms JEE lets an authentica
Arbitrary code execution is possible in Adobe Experience Manager 6.5 Forms JEE and AEM 6.5 LTS Forms JEE via an improper
Server-side request forgery in Adobe Experience Manager Forms JEE lets an attacker who already holds high-privileged, ad
Stored cross-site scripting in Adobe Experience Manager 6.5 Forms JEE and 6.5 LTS Forms JEE lets a high-privileged, auth
Cross-site request forgery in Adobe Experience Manager Forms JEE (AEM 6.5 and 6.5 LTS) lets an attacker forge requests t
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today