CVE-2021-21083: Adobe Experience Manager broken access control in DSRPReindexServlet could lead to denial-of-service

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-28 · updated 2026-06-17
Weakness: CWE-284

Description

AEM's Cloud Service offering, as well as versions 6.5.7.0 (and below), 6.4.8.3 (and below) and 6.3.3.8 (and below) are affected by an Improper Access Control vulnerability. An unauthenticated attacker could leverage this vulnerability to cause an application denial-of-service in the context of the current user.

Affected products

Adobe Experience Manager: through 6.3.3.8; from 6.4.0.0 before 6.4.8.4; from 6.5.0.0 before 6.5.8.0 — fixed in 6.4.8.4, 6.5.8.0
Adobe Experience Manager Cloud Service: all versions

How to fix

Upgrade to a fixed version: Adobe Experience Manager 6.4.8.4, 6.5.8.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-21083 or the next vulnerability affects your stack