1. Home
  2. CVE Database
  3. CVE-2021-40722
CRITICAL · 9.8

CVE-2021-40722

AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.

Vulnerability Description

AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
AdobeExperience Manager<= 6.5.10.0
AdobeExperience Manager Cloud Service-

Related Weaknesses (CWE)

CWE-611

References

FAQ

What is CVE-2021-40722?

CVE-2021-40722 is a vulnerability with a CVSS score of 9.8 (CRITICAL). AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.

How severe is CVE-2021-40722?

CVE-2021-40722 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2021-40722?

Check the references section above for vendor advisories and patch information. Affected products include: Adobe Experience Manager, Adobe Experience Manager Cloud Service.