{"id":"CVE-2021-40722","aliases":["EUVD-2021-27887","GHSA-7h8f-9m99-6cfg"],"status":"published","title":"AEM Forms Improper Restriction of XML External Entity Reference","description":"AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0338,"percentile":0.88869,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611"],"published":"2022-01-13T20:27:18Z","modified":"2026-06-17T04:07:19Z","products":[{"vendor":"adobe","product":"experience manager"},{"vendor":"adobe","product":"experience_manager"},{"vendor":"adobe","product":"experience_manager_cloud_service"},{"vendor":"sitecore","product":"experience manager"}],"references":[{"url":"https://helpx.adobe.com/security/products/experience-manager/apsb21-103.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40722"},{"url":"https://github.com/advisories/GHSA-7h8f-9m99-6cfg"}],"sources":{"cve":[{"id":"CVE-2021-40722","title":"AEM Forms Improper Restriction of XML External Entity Reference","description":"AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.","status":"published","published":"2022-01-13T20:27:18.222Z","modified":"2024-09-16T22:10:35.865Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:33:01.495293Z"}],"euvd":[{"id":"EUVD-2021-27887","description":"AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.","status":"published","published":"2022-01-13T20:27:18Z","modified":"2024-09-16T22:10:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:55:05.279117Z"}],"ghsa":[{"id":"GHSA-7h8f-9m99-6cfg","title":"AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML...","description":"AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.","status":"published","published":"2022-01-14T00:02:05Z","modified":"2023-02-03T05:04:30Z","cwes":["CWE-611"],"updated_at":"2026-11-02T14:53:33.746621Z"}],"nvd":[{"id":"CVE-2021-40722","description":"AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.","status":"published","published":"2022-01-13T21:15:07.897Z","modified":"2026-06-17T04:07:19.883Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:07:03.418194Z"}]}}