Cyber & AI intelligence
Wasteland.
Briefs indexed2842
Issues29
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-75745 2026-09-22

Adobe Experience Manager Forms JEE Hits CVSS 10.0 With Unauthenticated Code Execution

"Adobe has patched CVE-2026-75745, an Incorrect Authorization flaw in AEM Forms JEE that scores a maximum 10.0 CVSS and allows arbitrary code execution with no authentication and no user interaction."

Adobe has patched CVE-2026-75745, an Incorrect Authorization flaw in AEM Forms JEE that scores a maximum 10.0 CVSS and allows arbitrary code execution with no authentication and no user interaction.

What Is It

CVE-2026-75745 is an Incorrect Authorization vulnerability (CWE-863) in Adobe Experience Manager Forms JEE. Per Adobe's advisory, the flaw "could result in arbitrary code execution in the context of the current user," and exploitation "does not require user interaction."

The CVSS 3.1 vector, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, gives it a base score of 10.0, CRITICAL. That breaks down to network-reachable attack surface, low attack complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity, and availability. Notably, scope is changed (S:C), meaning successful exploitation reaches resources beyond the vulnerable component's own security authority. The exploitability subscore is the maximum 3.9.

Why It Matters

A 10.0 is rare, and the vector explains why: an unauthenticated attacker with network access to an affected AEM Forms JEE instance can reach code execution without tricking a user into anything. The changed scope means the blast radius isn't confined to the Forms application itself.

AEM Forms JEE deployments typically front document and form workflows for enterprise and government organizations, making internet-exposed instances a high-value target. The CVE was published to NVD on 2026-09-22, where it currently sits in "Awaiting Analysis" status. Neither Adobe's bulletin nor the NVD record names a reporter or credits a specific party with the discovery.

CVE-2026-75745 is not listed in CISA's Known Exploited Vulnerabilities catalog, so active exploitation has not been confirmed at this time.

What's Vulnerable

Two product lines are affected:

No CPE matches have been published in NVD yet, so automated vulnerability scanners may not flag affected assets until analysis completes. Version-based inventory checks are the reliable path right now.

Patch Status

Fixed builds are available:

Note that 6.5.25 alone is still flagged as affected; the hotfix is the operative fix for that branch. Adobe's advisory APSB26-151 is the authoritative source for installation details. Given the unauthenticated, no-interaction profile, patching should be treated as urgent for any externally reachable instance.

Sources