Code Can Run Before the Login Boundary
An account is not a prerequisite for every route into a forms server. The six paths in this update require separate triage: some start before login, while others require an existing privileged account or another person’s browser.
Vendor notice addresses AEM Forms JEE. The lead flaw concerns incorrect authorisation. Its remote route needs no specialised conditions. The table uses the six current official records, individually linked through their matching BlackTree reports.
Keep the prerequisites distinct
| Record | Effect | Required access or action | Current record score |
|---|---|---|---|
| CVE-2026-75745 | Runs supplied instructions as the active user | No account or user action | 10.0 |
| CVE-2026-81995 | Runs supplied instructions as the active user | High privileges; no user action | 9.1 |
| CVE-2026-82000 | Reaches internal resources through forged server requests | Low privileges; no user action | 9.6 |
| CVE-2026-81999 | Reaches internal resources through forged server requests | High privileges; no user action | 8.7 |
| CVE-2026-75744 | A saved script executes in another person’s browser | High privileges; victim views the affected form | 8.1 |
| CVE-2026-75743 | Circumvents protections; permits unauthorised writes and limited service disruption | No account; victim follows hostile content | 7.1 |
The vendor prints 9.8 and 9.1 for the first and third entries, despite giving the same vectors. It marks every row Critical; the current records classify the final three as High. The September notice uses the vendor’s older severity scheme; its labels are separate from the current score bands. The numeric discrepancy still needs explicit attribution.
Match the branch to its update
On the 6.5 LTS line, move SP2 or earlier to SP3. Standard releases through 6.5.25 need that base version with hotfix AEMForms-6.5.0-0134. Ask vendor support about 6.4, 6.3 and 6.2.
- Inventory this runtime separately from the vendor’s other web components.
- Record each node’s product line, maintenance level, installed patches and operating system.
- Prioritise Internet-facing nodes and the first row’s unauthenticated path.
- Apply the update for the correct branch, then verify the running build.
- Review authentication, application and outbound-request logs for the exposed period.
- Treat the absence of reported exploitation as an evidence limit, not proof that an instance escaped probing.
The vendor assigns priority 2, ordinarily a 30-day deployment window under its published rating policy. BlackTree recommends setting the local deadline from exposure, data sensitivity and the ability to investigate that period. The vendor’s bulletin reports no known exploitation; the reviewed official records also retain dated assessments with no reported exploitation. Neither establishes that a particular system was untouched, and this review does not establish a public exploit demonstration.
Sources
The six official records were checked on 27 October 2026. Their individual publication and update times remain visible in the linked data.
- Vendor bulletin, 2026-09-22; no displayed publication clock.
- Official record 1.
- Official record 2.
- Official record 3.
- Official record 4.
- Official record 5.
- Official record 6.
- Rating policy, updated 2026-10-13.
- SecurityWeek report, 2026-09-23, 07:40 ET.
