Adobe Experience Manager Forms JEE APSB26-151 (CVE records published 22 September 2026, 18:56 UTC; 23 September, 2:56 am Perth) patches six vulnerabilities. Adobe's CVE records score them as follows (CVSS 3.1): CVE-2026-75745 (incorrect authorization → arbitrary code execution) 10.0 Critical; CVE-2026-82000 (SSRF → privilege escalation) 9.6 Critical; CVE-2026-81995 (improper input validation → arbitrary code execution) 9.1 Critical; CVE-2026-81999 (SSRF → privilege escalation) 8.7 High; CVE-2026-75744 (stored cross-site scripting) 8.1 High; and CVE-2026-75743 (CSRF → security feature bypass) 7.1 High.

Affected: AEM 6.5 Forms JEE 6.5.25 and AEM 6.5 LTS Forms JEE SP2. Fixes: a hotfix for 6.5.25; 6.5 LTS SP3. Companion to Connect APSB26-150 same day. (sources: Adobe APSB26-151 helpx; Adobe's CVE records)

Correction (24 Oct 2026): Adobe's CVE record scores CVE-2026-75745 at 10.0 (CVSS 3.1; no privileges or user interaction needed), so it, not CVE-2026-82000 (9.6), is the highest-rated flaw in APSB26-151. (source: CVE record CVE-2026-75745 (Adobe))

Correction (25 Oct 2026): an earlier correction on this card gave severity ratings and scores from Adobe's bulletin that we could not verify; the card now gives only the scores in Adobe's CVE records, and a report credit we could not verify has been removed. (source: CVE.org)

Correction (25 Oct 2026): the card date has moved from 22 to 23 September 2026, the Perth date of the publication of Adobe's CVE records (22 September, 18:56 UTC; 23 September, 2:56 am Perth). (source: CVE.org)

Correction (26 Oct 2026): an earlier update today restored severity ratings from Adobe's APSB26-151 bulletin; Cyberstack's plain request for the bulletin was redirected (HTTP 301) rather than answered, so that update has been withdrawn and the card again gives only the scores in Adobe's CVE records.

The hotfix name, Adobe's priority rating and its statement on in-the-wild exploitation, which came from the bulletin, have also been removed. (source: CVE.org)