DocumentationAEM 6.5User Guide

Mitigating Apache Axis Document Security web service vulnerability for Experience Manager Forms on JEE mitigating-apache-axis-document-security-webservice-vulnerability-for-aem-forms-jee

Last update: July 7, 2026
  • Applies to:
  • Experience Manager 6.5

CREATED FOR:

  • Admin

Issue

A critical authorization weakness (CWE-863: Incorrect Authorization) can affect the Document Security (Adobe Rights Management) EDC web service module shipped with Experience Manager Forms on JEE. The module uses Apache Axis for SOAP endpoints. When administrative Axis capabilities are exposed without proper authentication and network controls, an attacker could potentially deploy arbitrary web services, which may lead to remote code execution on the application server.

Vulnerability
What’s impacted?
What’s not impacted?
Apache Axis web service configuration in Document Security (edc-webservice.war)
Experience Manager 6.5 Forms on JEE deployments that include the Document Security / Rights Management Server EAR, across all Service Packs up to and including 6.5.24.0, and all Service Packs leading to 6.5 LTS that ship the affected web service.
  • Experience Manager Forms Workbench (all versions)
  • Experience Manager Forms on OSGi (all versions)
  • Experience Manager Forms as a Cloud Service
NOTE
Exact risk depends on your deployment topology, application server, and whether the AEM Forms Document Security / Rights Management is enabled. Adobe recommends mitigating every Forms on JEE environment where AEM Forms Document Security / Rights Management is enabled, using either the hotfix (where available for your service pack) or the manual steps below.

Resolution

The remediation path depends on which AEM Forms on JEE service pack you are running:

  • Experience Manager 6.5 Forms on JEE with 6.5 Service Pack 24 (for example, 6.5.24.0): Install the Adobe-provided hotfix for Document Security from Software Distribution. Use the package that matches Service Pack 24; see the package description and release note on Software Distribution for the exact file name and version.
  • Experience Manager 6.5 Forms on JEE with 6.5 LTS Service Pack 2: Install the Adobe-provided hotfix for Document Security from Software Distribution. Use the package that matches 6.5 LTS SP2; see the package description and release note for the exact file name and version.
  • Any other supported version (including 6.5 Service Pack 21–23, 6.5 LTS Service Pack 1, or earlier 6.5 Forms on JEE releases that include Document Security): Do not rely on the Service Pack 24 / LTS SP2 hotfix installer for this issue. Follow the manual mitigation steps in this article.

The following table is a quick reference.

If your deployment is on…
User action
6.5 Service Pack 24
Install the Document Security hotfix from Software Distribution.
6.5 LTS Service Pack 2
Install the Document Security hotfix from Software Distribution.
Any other version (for example, 6.5 SP21–SP23, 6.5 LTS SP1, or earlier)
Apply the manual mitigation steps only.
IMPORTANT
Always back up your EAR files and database before applying a hotfix or editing deployment artifacts. Schedule a maintenance window and follow your change-management process.

Use manual mitigation steps use-manual-mitigation-steps

Use these steps when your environment is not on 6.5 Service Pack 24 or 6.5 LTS Service Pack 2 (those levels should use the Adobe-provided hotfix from Software Distribution instead). Also use manual mitigation when Adobe documentation or Support directs you to replace configuration inside the EDC web service archive, or when you are applying files supplied by Adobe (for example, server-config.wsdd and web.xml).

  1. Download the remediated configuration files (or the configuration file zip) from the Software Distribution portal. Use the package and release note that match your AEM Forms on JEE version.

  2. Shut down all affected AEM Forms on JEE application server instances (and any related cluster members, if applicable).

  3. On the machine where AEM Forms on JEE is installed, go to <AEM_Forms_Installation_DIR>/deploy.

  4. Back up the original EAR (for rollback only). Copy adobe-edcserver-<jboss|weblogic|websphere>.ear to a separate safe location or a different file name. Do not edit the backup. All changes in the following steps apply only to the main EAR file that remains in deploy.

  5. Open the adobe-edcserver-<jboss|weblogic|websphere>.ear file in <AEM_Forms_Installation_DIR>/deploy (not the backup). Inside that EAR, open edc-webservice.war, then replace these files under WEB-INF/ with the versions you downloaded:

    • WEB-INF/server-config.wsdd
    • WEB-INF/web.xml

    The path from the EAR root to edc-webservice.war depends on your application server:

    table 0-row-2 1-row-2 2-row-2 3-row-2
    Application server Path inside the EAR to WEB-INF
    JBoss adobe-edcserver-jboss.ear → lib/edc-webservice.war → WEB-INF/
    WebLogic adobe-edcserver-weblogic.ear → lib/edc-webservice.war → WEB-INF/
    WebSphere adobe-edcserver-websphere.ear → lib/edc-webservice.war → WEB-INF/
    note
    NOTE
    EAR and WAR layouts can vary slightly by version. If the path differs on your installation, search within the deploy copy of adobe-edcserver-<jboss|weblogic|websphere>.ear for edc-webservice.war, then update the same WEB-INF files inside that WAR.

  6. Save the updated edc-webservice.war inside the EAR and save the adobe-edcserver-<jboss|weblogic|websphere>.ear in deploy, keeping valid archive structure. The modified EAR must remain in <AEM_Forms_Installation_DIR>/deploy.

  7. Run LiveCycle Configuration Manager (LCM) to deploy the updated EAR file from deploy to the application server, consistent with your standard AEM Forms on JEE deployment procedure.

  8. Start the application server and perform smoke tests for Document Security / policy-protected document workflows.

CAUTION
If you run Configuration Manager again, contents under <AEM_Forms_Installation_DIR>/configurationManager/export may be regenerated from sources under deploy. To avoid losing the mitigation, ensure the remediated adobe-edcserver-<jboss|weblogic|websphere>.ear in deploy (or the source location your team uses for exports) already contains the updated edc-webservice.war before regenerating exports. After upgrades or patches, confirm that the mitigation is still present or reapply as directed by Adobe.

References

Who should I contact if I have additional questions or issues performing these steps?

Contact Adobe Support or submit a support ticket.

recommendation-more-help
experience-manager-65-help-main-toc