Adobe AEM Forms on JEE Update Addresses 6 Vulnerabilities
Tech GuruQuick Answer
Adobe's AEM Forms on JEE update addresses six Critical vulnerabilities. The supported targets are AEM 6.5 LTS Forms SP3 or AEM 6.5.25 with hotfix AEMForms-6.5.0-0134. A base installation reporting 6.5.25 is still within the affected range unless the required hotfix is present.
Confirm Scope And Apply The Supported Fix
What to do now: Identify JEE Forms installations and distinguish LTS from the 6.5 branch. Follow Adobe's matching update instructions and verify the service pack or hotfix on every applicable node.
Last verified: 2026-09-23 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Adobe AEM Forms on JEE |
|---|---|
| Advisory | APSB26-151 |
| CVEs | CVE-2026-75743, CVE-2026-75744, CVE-2026-75745, CVE-2026-81995, CVE-2026-81999, CVE-2026-82000 |
| Adobe bulletin publication | 2026-09-22 (Adobe bulletin) |
| Recorded source timestamp (historical snapshot) | 2026-09-22 18:56:04.606 UTC |
| Affected versions | AEM 6.5 LTS Forms SP2 and earlier, and AEM 6.5 Forms 6.5.25 and earlier |
| Fixed version | AEM 6.5 LTS Forms SP3, or AEM 6.5.25 with hotfix AEMForms-6.5.0-0134 |
| CVSS base score | 7.1 / 8.1 / 8.7 / 9.1 / 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | Adobe states that it is not aware of exploitation; no exploitation claim is inferred. |
What Changed
The six flaws have different prerequisites: incorrect authorization can permit unauthenticated code execution; another input-validation issue requires high privileges; the two SSRF issues require low or high privileges; stored XSS requires high privileges and user interaction; CSRF requires user interaction. A high aggregate rating does not make all six unauthenticated attacks. Adobe reports no known exploitation in the wild.
What To Validate Now
- Inventory. Locate Adobe AEM Forms on JEE deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Compare each deployment with the authority's affected-version statement: AEM 6.5 LTS Forms SP2 and earlier, and AEM 6.5 Forms 6.5.25 and earlier Do not infer applicability from product family or severity alone.
- Remediate. Apply AEM 6.5 LTS Forms SP3, or AEM 6.5.25 with hotfix AEMForms-6.5.0-0134 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Check the actual SP3 or AEMForms-6.5.0-0134 installation evidence, not only the base 6.5.25 version string. Test approved forms submission, document processing, authentication and clustered-node health, retaining recovery results.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
This bulletin concerns Forms on JEE, not every AEM deployment. Adobe directs customers on 6.4, 6.3 or 6.2 to customer care. Do not apply an LTS service pack to another branch or assume an older unsupported release is unaffected; obtain the correct update prerequisites before rollout.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
