CVE-2021-40722: Adobe Experience Manager

Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days.

AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.

Affected products

• Adobe Experience Manager: up to and including 6.5.10.0
• Adobe Experience Manager Cloud Service: affected versions not specified

Published 2022-01-13. Last modified 2026-06-17.