AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

AdobeCVE-2026-81999

Adobe AEM 6.5: server-side request forgery

Adobe

CVE-2026-81999 · Published Sep 22, 2026 · updated Sep 23, 2026

High8.7
No fix yet
Adobe advisory

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

Affected versions

PackageAffectedFixed in
AEM 6.5 Forms JEE
Product
<= 6.5.25No fix yet
AEM 6.5 LTS Forms JEE
Product
<= 6.5 LTS SP2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-918

More Adobe advisories

All Adobe
Medium 5.5Sep 22Adobe Content Credentials: integer overflowCVE-2026-89277no fix yetHigh 7.8Sep 22Adobe Substance3D - Modeler: out-of-bounds writeCVE-2026-83963no fix yetMedium 6.2Sep 22Adobe Connect: improper certificate validationCVE-2026-83964no fix yetHigh 7.1Sep 22Adobe Premiere: server-side request forgeryCVE-2026-84395no fix yetMedium 5.5Sep 22Adobe InDesign Desktop: null pointer dereferenceCVE-2026-84396no fix yetHigh 7.8Sep 22Adobe Substance3D - Modeler: out-of-bounds writeCVE-2026-81998no fix yet