# CVE-2026-81999

SSRF in Adobe AEM Forms JEE enabling privilege escalation

- Page: https://www.vulneraibility.com/cve/CVE-2026-81999
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.81% (percentile 57.0)
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-09-22)
- Weakness: CWE-918
- Published: 2026-09-22

## Affected versions

- Adobe AEM 6.5 Forms JEE: affected <= 6.5.25; fixed in 6.5.25 (AEMForms-6.5.0-0134 Hotfix)
- Adobe AEM 6.5 LTS Forms JEE: affected <= 6.5 LTS SP2; fixed in 6.5 LTS SP3

A version outside these ranges is not a statement that it is unaffected.

## Impact

SSRF lets attackers access internal services and escalate privileges, enabling data access, lateral movement, and service compromise.

## Action

Immediate action required

## Recommendation

Apply vendor mitigations/patches, restrict SSRF targets, isolate affected instances and review logs

## References

- [advisory] https://helpx.adobe.com/security/products/aem-forms/apsb26-151.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.