Adobe has disclosed a critical server-side request forgery flaw in AEM Forms JEE, scored CVSS 9.6. According to Adobe's advisory, the issue could allow a low-privileged attacker to reach internal resources and escalate privileges without any user interaction. No public exploit or exploitation activity has been reported.
What Is It
CVE-2026-82000 is a Server-Side Request Forgery vulnerability (CWE-918) in Adobe Experience Manager Forms JEE. Per Adobe's PSIRT description, the flaw "could result in privilege escalation," allowing a low-privileged attacker to "gain elevated access to internal resources."
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base score 9.6, rated CRITICAL. Breaking that down: the vulnerability is reachable over the network, attack complexity is low, and exploitation requires no user interaction. The attacker does need some level of existing privilege (PR:L), but scope is changed, meaning the impact crosses a security boundary beyond the vulnerable component itself. Confidentiality and integrity impact are both HIGH; availability is unaffected.
The record was published 2026-09-22 and is currently in "Awaiting Analysis" status at NVD, with metrics supplied by Adobe as the primary source.
Why It Matters
The combination of network reach, low attack complexity, no user interaction, and changed scope is what drives the 9.6 score. SSRF that yields privilege escalation against internal resources is a pivot primitive: an attacker with a low-privilege foothold uses the server to reach things the server can reach and they cannot.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the wild at this time, and no KEV-mandated remediation deadline.
What's Vulnerable
Two product lines are affected:
- AEM 6.5 Forms JEE: all versions up to and including 6.5.25 are affected.
- AEM 6.5 LTS Forms JEE: all versions up to and including 6.5 LTS SP2 are affected.
Adobe lists all other versions as unaffected by default.
Patch Status
Adobe has shipped fixes for both branches:
- AEM 6.5 Forms JEE: apply 6.5.25 with the AEMForms-6.5.0-0134 Hotfix, listed as unaffected.
- AEM 6.5 LTS Forms JEE: upgrade to 6.5 LTS SP3, listed as unaffected.
Note that for the 6.5 branch, the base 6.5.25 release alone is still in the affected range; the hotfix is the fixed configuration. Full details are in Adobe security bulletin APSB26-151.
Sources
- NVD, CVE-2026-82000: https://nvd.nist.gov/vuln/detail/CVE-2026-82000
- Adobe Security Bulletin APSB26-151 (AEM Forms): https://helpx.adobe.com/security/products/aem-forms/apsb26-151.html