Adobe Experience Manager 6.5 and its LTS release contain an OS command injection flaw that allows an attacker to execute arbitrary commands in the context of the application. The vulnerability is not dependent on user interaction, applies to a low‑privileged attacker, and results in a change of scope that grants persistent code execution.

Adobe Experience Manager 6.5 and the 6.5 Long Term Support edition are the affected products. The vulnerability applies to all instances running these versions that have not applied the relevant Adobe security update.

The flaw has a CVSS score of 9.9, indicating critical severity, and is not listed in the CISA KEV catalog. EPSS score of 1% indicates a low probability of exploitation, but the lack of user interaction and the low‑privileged nature of the attacker suggest that exploitation could still occur frequently in a production environment. The change in scope means that an attacker could potentially elevate privileges or modify the system without additional authentication.