DocumentationAEM 6.5 LTSUser Guide

Mitigating Server-Side Request Forgery (SSRF) Vulnerabilities for AEM Forms on JEE 6.5 LTS SP2

Last update: June 30, 2026
  • Applies to:
  • Experience Manager 6.5 LTS

CREATED FOR:

  • User
  • Admin
  • Developer

Quick Reference quick-reference

Impact Level
Affected Versions
Recommended Action
Critical
AEM Forms on JEE 6.5 LTS Service Pack 2 (6.5 LTS SP2)
Manually install the hotfix
Not Affected
AEM Forms on OSGi, Workbench, Cloud Service
No action required

Vulnerabilities Addressed:

  • Server-Side Request Forgery (SSRF) (CWE-918)

Overview overview

What’s Affected whats-affected

Vulnerability
Impact
Affected Components
Server-Side Request Forgery (SSRF) (CWE-918)
Attackers may induce the server to make unintended requests to internal or external resources
AEM Forms on JEE 6.5 LTS SP2

What’s Not Affected whats-not-affected

  • Experience Manager Forms Workbench (all versions)
  • Experience Manager Forms on OSGi (all versions)
  • Experience Manager Forms as a Cloud Service

Resolution Options resolution-options

Before You Start before-you-start

Before making any changes, take a backup of the EAR file you are about to replace:

  • Locate adobe-edcserver-jboss.ear in your deployment directory:

    code language-text 
    [AEM installation directory]/deploy/adobe-edcserver-jboss.ear

  • Copy the file to a secure backup location outside the deployment directory.

  • Ensure the backup is complete and accessible before proceeding with any updates.

This precaution allows you to restore the original state in case you encounter any issues during the update process.

Manual Hotfix Installation for AEM Forms on JEE 6.5 LTS SP2 (JBoss)

  1. Download adobe-edcserver-jboss.ear from the Adobe Software Distribution Portal.

  2. Locate adobe-edcserver-jboss.ear in your deployment directory and replace it with the downloaded file:

    code language-text 
    [AEM installation directory]/deploy/adobe-edcserver-jboss.ear

  3. Launch the AEM Forms Configuration Manager to re-deploy the updated EAR and apply the hotfix.

  4. Restart the application server and confirm successful deployment from the server logs.

Reference references

recommendation-more-help
experience-manager-65-lts-help-main-toc