What’s Vulnerable › Vulnerabilities

CVE-2021-40722: AEM Forms Improper Restriction of XML External Entity Reference

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-01-13 · updated 2026-06-17
• Weakness: CWE-611

Description

AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.

Affected products

• Adobe Experience Manager: through 6.5.10.0
• Adobe Experience Manager Cloud Service: all versions

References

• https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html
• https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html

Get alerted when CVE-2021-40722 or the next vulnerability affects your stack