Adobe Experience Manager Forms JEE APSB26-151 (CVE records published 22 September 2026, 18:56 UTC; 23 September, 2:56 am Perth) patches six vulnerabilities. Adobe's CVE records score them as follows (CVSS 3.1): CVE-2026-75745 (incorrect authorization → arbitrary code execution) 10.0 Critical; CVE-2026-82000 (SSRF → privilege escalation) 9.6 Critical; CVE-2026-81995 (improper input validation → arbitrary code execution) 9.1 Critical; CVE-2026-81999 (SSRF → privilege escalation) 8.7 High; CVE-2026-75744 (stored cross-site scripting) 8.1 High; and CVE-2026-75743 (CSRF → security feature bypass) 7.1 High.

Affected: AEM 6.5 Forms JEE 6.5.25 and AEM 6.5 LTS Forms JEE SP2. Fixes: 6.5.25 with AEMForms-6.5.0-0134 Hotfix; 6.5 LTS SP3. Priority 2. Adobe not aware of in-the-wild exploitation.

Companion to Connect APSB26-150 same day. Primary: Adobe APSB26-151 helpx; scores: Adobe's CVE records (CVE.org).

Correction (24 Oct 2026): Adobe's CVE record scores CVE-2026-75745 at 10.0 (CVSS 3.1; no privileges or user interaction needed), so it, not CVE-2026-82000 (9.6), is the highest-rated flaw in APSB26-151. (source: CVE record CVE-2026-75745 (Adobe))

Correction (25 Oct 2026): an earlier correction on this card gave severity ratings and scores from Adobe's bulletin that we could not verify; the card now gives only the scores in Adobe's CVE records, and a wire credit we could not verify has been removed. (source: CVE.org)

Correction (25 Oct 2026): the card date has moved from 22 to 23 September 2026, the Perth date of the publication of Adobe's CVE records (22 September, 18:56 UTC; 23 September, 2:56 am Perth). (source: CVE.org)