Aem 6 5 Forms Jee
Monthly
Cross-site request forgery in Adobe Experience Manager Forms JEE (AEM 6.5 and 6.5 LTS) lets an attacker forge requests that bypass a security control and perform unauthorized writes on behalf of a logged-in user, producing a limited availability disruption. The attacker requires no authentication of their own (CVSS vector PR:N), but exploitation depends entirely on a victim who holds a valid AEM Forms JEE session being induced to visit a malicious URL or interact with a compromised page (UI:R); there is no confidentiality impact, and integrity (I:H) plus a minor availability effect (A:L) account for the 7.1 base score. No public exploit code has been identified at time of analysis, and real-world risk is best judged as moderate rather than critical given the victim-interaction prerequisite.
Incorrect authorization in Adobe Experience Manager Forms JEE (the 6.5 and 6.5 LTS branches) allows a remote, unauthenticated attacker to bypass intended access controls and execute arbitrary code in the context of the running AEM service account, with no user interaction required. The scope-change (S:C) rating and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H produce a maximum 10.0 base score, reflecting that successful exploitation can affect resources beyond the vulnerable component itself. Exposure is limited to deployments where the Forms JEE component is installed and network-reachable - typically internet- or intranet-facing AEM Forms servers - and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) was identified, though the pre-authorization nature of the flaw makes it an attractive target for rapid weaponization.
Server-side request forgery in Adobe Experience Manager (AEM) 6.5 Forms JEE and AEM 6.5 LTS Forms JEE lets an authenticated low-privilege user coerce the Forms server into making HTTP requests to internal-only resources, which can cross a security boundary (CVSS scope change) and yield elevated access. The flaw is rated 9.6 by the vendor and assessed at 9.6/9.6-class severity with the confidentiality impact confirmed as high, while integrity impact is bounded by what the reachable internal endpoints actually allow. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS signal was not notable in the supplied data.
Stored cross-site scripting in Adobe Experience Manager 6.5 Forms JEE and 6.5 LTS Forms JEE lets a high-privileged, authenticated attacker plant malicious JavaScript inside form fields that executes in a victim's browser when the poisoned form page is rendered, with a scope change that can extend impact to the victim's session or account. The CVSS vector confirms the prerequisites: PR:H means the attacker must already hold an elevated AEM account able to write form content, and UI:R means a victim must actively browse to the affected page, so realistic exposure is limited to malicious insiders or attackers who have already compromised high-privilege AEM credentials. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 8.1 score is driven by the high confidentiality and integrity impact on the victim's session rather than by an easy unauthenticated path, making this a genuine but constrained-priority issue rather than a drop-everything emergency.
Arbitrary code execution is possible in Adobe Experience Manager 6.5 Forms JEE and AEM 6.5 LTS Forms JEE via an improper input validation weakness (CWE-20) that is reachable over the network with low attack complexity and no user interaction. Exploitation is gated by a mandatory prerequisite: the attacker must already hold a high-privilege account on the affected AEM Forms JEE instance (CVSS vector PR:H), so only administrative-level users, or an attacker who has first compromised such an account, can reach the vulnerable code path - the assessed risk is genuine but access-gated. Code runs in the context of the current user, and the changed scope (S:C) means impact can extend beyond the vulnerable component; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV).
Server-side request forgery in Adobe Experience Manager Forms JEE lets an attacker who already holds high-privileged, admin-level application access coerce the AEM Forms JEE server into issuing requests to internal-only resources, achieving privilege escalation and a scope change beyond the original AEM security perimeter. Affected deployments are AEM 6.5 Forms JEE and AEM 6.5 LTS Forms JEE, reachable over the network (AV:N) with no end-user interaction (UI:N) but gated behind the PR:H privileged-authentication requirement, so practical risk concentrates on malicious insiders or attackers who have already compromised an administrative account. Based on the supplied intelligence there is no CISA KEV listing and no public exploit code identified at time of analysis; the high EPSS-style urgency implied by the CVSS 8.7 base score reflects the scope change and confidentiality/integrity impact rather than demonstrated exploitation.
Cross-site request forgery in Adobe Experience Manager Forms JEE (AEM 6.5 and 6.5 LTS) lets an attacker forge requests that bypass a security control and perform unauthorized writes on behalf of a logged-in user, producing a limited availability disruption. The attacker requires no authentication of their own (CVSS vector PR:N), but exploitation depends entirely on a victim who holds a valid AEM Forms JEE session being induced to visit a malicious URL or interact with a compromised page (UI:R); there is no confidentiality impact, and integrity (I:H) plus a minor availability effect (A:L) account for the 7.1 base score. No public exploit code has been identified at time of analysis, and real-world risk is best judged as moderate rather than critical given the victim-interaction prerequisite.
Incorrect authorization in Adobe Experience Manager Forms JEE (the 6.5 and 6.5 LTS branches) allows a remote, unauthenticated attacker to bypass intended access controls and execute arbitrary code in the context of the running AEM service account, with no user interaction required. The scope-change (S:C) rating and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H produce a maximum 10.0 base score, reflecting that successful exploitation can affect resources beyond the vulnerable component itself. Exposure is limited to deployments where the Forms JEE component is installed and network-reachable - typically internet- or intranet-facing AEM Forms servers - and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) was identified, though the pre-authorization nature of the flaw makes it an attractive target for rapid weaponization.
Server-side request forgery in Adobe Experience Manager (AEM) 6.5 Forms JEE and AEM 6.5 LTS Forms JEE lets an authenticated low-privilege user coerce the Forms server into making HTTP requests to internal-only resources, which can cross a security boundary (CVSS scope change) and yield elevated access. The flaw is rated 9.6 by the vendor and assessed at 9.6/9.6-class severity with the confidentiality impact confirmed as high, while integrity impact is bounded by what the reachable internal endpoints actually allow. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS signal was not notable in the supplied data.
Stored cross-site scripting in Adobe Experience Manager 6.5 Forms JEE and 6.5 LTS Forms JEE lets a high-privileged, authenticated attacker plant malicious JavaScript inside form fields that executes in a victim's browser when the poisoned form page is rendered, with a scope change that can extend impact to the victim's session or account. The CVSS vector confirms the prerequisites: PR:H means the attacker must already hold an elevated AEM account able to write form content, and UI:R means a victim must actively browse to the affected page, so realistic exposure is limited to malicious insiders or attackers who have already compromised high-privilege AEM credentials. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 8.1 score is driven by the high confidentiality and integrity impact on the victim's session rather than by an easy unauthenticated path, making this a genuine but constrained-priority issue rather than a drop-everything emergency.
Arbitrary code execution is possible in Adobe Experience Manager 6.5 Forms JEE and AEM 6.5 LTS Forms JEE via an improper input validation weakness (CWE-20) that is reachable over the network with low attack complexity and no user interaction. Exploitation is gated by a mandatory prerequisite: the attacker must already hold a high-privilege account on the affected AEM Forms JEE instance (CVSS vector PR:H), so only administrative-level users, or an attacker who has first compromised such an account, can reach the vulnerable code path - the assessed risk is genuine but access-gated. Code runs in the context of the current user, and the changed scope (S:C) means impact can extend beyond the vulnerable component; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV).
Server-side request forgery in Adobe Experience Manager Forms JEE lets an attacker who already holds high-privileged, admin-level application access coerce the AEM Forms JEE server into issuing requests to internal-only resources, achieving privilege escalation and a scope change beyond the original AEM security perimeter. Affected deployments are AEM 6.5 Forms JEE and AEM 6.5 LTS Forms JEE, reachable over the network (AV:N) with no end-user interaction (UI:N) but gated behind the PR:H privileged-authentication requirement, so practical risk concentrates on malicious insiders or attackers who have already compromised an administrative account. Based on the supplied intelligence there is no CISA KEV listing and no public exploit code identified at time of analysis; the high EPSS-style urgency implied by the CVSS 8.7 base score reflects the scope change and confidentiality/integrity impact rather than demonstrated exploitation.