Adobe has patched CVE-2026-75745, an Incorrect Authorization flaw in AEM Forms JEE that scores a maximum 10.0 CVSS and allows arbitrary code execution with no authentication and no user interaction.
What Is It
CVE-2026-75745 is an Incorrect Authorization vulnerability (CWE-863) in Adobe Experience Manager Forms JEE. Per Adobe's advisory, the flaw "could result in arbitrary code execution in the context of the current user," and exploitation "does not require user interaction."
The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, gives it a base score of 10.0, CRITICAL. That breaks down to network-reachable attack surface, low attack complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity, and availability. Notably, scope is changed (S:C), meaning successful exploitation reaches resources beyond the vulnerable component's own security authority. The exploitability subscore is the maximum 3.9.
Why It Matters
A 10.0 is rare, and the vector explains why: an unauthenticated attacker with network access to an affected AEM Forms JEE instance can reach code execution without tricking a user into anything. The changed scope means the blast radius isn't confined to the Forms application itself.
AEM Forms JEE deployments typically front document and form workflows for enterprise and government organizations, making internet-exposed instances a high-value target. The CVE was published to NVD on 2026-09-22, where it currently sits in "Awaiting Analysis" status. Neither Adobe's bulletin nor the NVD record names a reporter or credits a specific party with the discovery.
CVE-2026-75745 is not listed in CISA's Known Exploited Vulnerabilities catalog, so active exploitation has not been confirmed at this time.
What's Vulnerable
Two product lines are affected:
- AEM 6.5 Forms JEE: all versions up to and including 6.5.25
- AEM 6.5 LTS Forms JEE: all versions up to and including 6.5 LTS SP2
No CPE matches have been published in NVD yet, so automated vulnerability scanners may not flag affected assets until analysis completes. Version-based inventory checks are the reliable path right now.
Patch Status
Fixed builds are available:
- AEM 6.5 Forms JEE: apply 6.5.25 with the AEMForms-6.5.0-0134 Hotfix: listed as unaffected
- AEM 6.5 LTS Forms JEE: upgrade to 6.5 LTS SP3: listed as unaffected
Note that 6.5.25 alone is still flagged as affected; the hotfix is the operative fix for that branch. Adobe's advisory APSB26-151 is the authoritative source for installation details. Given the unauthenticated, no-interaction profile, patching should be treated as urgent for any externally reachable instance.
Sources
- Adobe Security Bulletin APSB26-151 (AEM Forms), https://helpx.adobe.com/security/products/aem-forms/apsb26-151.html
- NVD, CVE-2026-75745, https://nvd.nist.gov/vuln/detail/CVE-2026-75745