The vulnerability is an Improper Input Validation flaw in Adobe Experience Manager 6.5. Attackers can supply crafted input that bypasses validation, enabling arbitrary code execution under the context of the user who is running the instance. The flaw can allow an attacker to gain elevated privileges or control the victim’s account or session. Because the issue changes scope, compromised accounts can affect system-wide integrity and availability.

Adobe Experience Manager 6.5. No other affected versions are listed. The issue is specific to this product and version.

The CVSS score of 9.9 indicates critical severity. The EPSS score is not available, but the vulnerability is listed as not in KEV, so no publicly known exploitation information exists. The flaw does not require user interaction, implying that a remote attacker can trigger it automatically through a web request or API call, and the fact that it changes scope increases the potential system-wide impact. Attackers could achieve local or remote command execution by sending malicious input to the exposed interfaces.