CVE-2026-75745 - Vulnerability Details - OpenCVE

Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Adobe	Aem 6.5 Forms Jee Aem 6.5 Lts Forms Jee

No data.

No data.

References

Link	Providers
https://helpx.adobe.com/security/products/aem-forms/apsb26-151.html

History

Sat, 26 Sep 2026 00:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 23 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Adobe Adobe aem 6.5 Forms Jee Adobe aem 6.5 Lts Forms Jee
Vendors & Products		Adobe Adobe aem 6.5 Forms Jee Adobe aem 6.5 Lts Forms Jee

Tue, 22 Sep 2026 19:00:00 +0000

Type	Values Removed	Values Added
Description		Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Title		Adobe Experience Manager Forms JEE \| Incorrect Authorization (CWE-863)
Weaknesses		CWE-863
References		https://helpx.adobe.com/security/products/aem-forms/apsb26-151.html
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: adobe

Published: 2026-09-22T18:56:02.861Z

Updated: 2026-09-26T00:05:55.031Z

Reserved: 2026-08-18T01:29:54.623Z

Link: CVE-2026-75745

Vulnrichment

Updated: 2026-09-26T00:05:51.544Z

NVD

Status : Awaiting Analysis

Published: 2026-09-22T19:16:47.510

Modified: 2026-09-26T01:17:02.017

Link: CVE-2026-75745

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75745", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-08-18T01:29:54.623Z", "datePublished": "2026-09-22T18:56:02.861Z", "dateUpdated": "2026-09-26T00:05:55.031Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "AEM 6.5 Forms JEE", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "6.5.25", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "6.5.25 (AEMForms-6.5.0-0134 Hotfix)", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "AEM 6.5 LTS Forms JEE", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "6.5 LTS SP2", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "6.5 LTS SP3", "versionType": "custom"}]}], "datePublic": "2026-09-22T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 10, "environmentalSeverity": "CRITICAL", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "NETWORK", "modifiedAvailabilityImpact": "HIGH", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "CHANGED", "modifiedUserInteraction": "NONE", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "CHANGED", "temporalScore": 10, "temporalSeverity": "CRITICAL", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "description": "Incorrect Authorization (CWE-863)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-09-22T18:56:02.861Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/aem-forms/apsb26-151.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Adobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-26T00:05:46.866746Z", "id": "CVE-2026-75745", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-26T00:05:55.031Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-75745", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-26T00:05:46.866746Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-26T00:05:51.544Z"}}], "cna": {"title": "Adobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "modifiedScope": "CHANGED", "temporalScore": 10, "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "CRITICAL", "availabilityImpact": "HIGH", "environmentalScore": 10, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "confidentialityImpact": "HIGH", "environmentalSeverity": "CRITICAL", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "HIGH", "modifiedUserInteraction": "NONE", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "AEM 6.5 Forms JEE", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.5.25"}, {"status": "unaffected", "version": "6.5.25 (AEMForms-6.5.0-0134 Hotfix)", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "AEM 6.5 LTS Forms JEE", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.5 LTS SP2"}, {"status": "unaffected", "version": "6.5 LTS SP3", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-09-22T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/aem-forms/apsb26-151.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization (CWE-863)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-09-22T18:56:02.861Z"}}}, "cveMetadata": {"cveId": "CVE-2026-75745", "state": "PUBLISHED", "dateUpdated": "2026-09-26T00:05:55.031Z", "dateReserved": "2026-08-18T01:29:54.623Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-09-22T18:56:02.861Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}