The vulnerability is a stored Cross‑Site Scripting flaw allowing malicious JavaScript to be injected into form fields. When an affected user views the page, the script runs in their browser, which can lead to session hijacking, theft of credentials, or unauthorized actions performed with the user’s privileges. The CVE notes that the vulnerability’s scope is changed, indicating that it can elevate the attacker’s authority within the application.

Adobe Experience Manager 6.5 and its 6.5 LTS release are affected. The advisory does not list specific sub‑versions, so all instances of these releases should be considered vulnerable until a patch is applied.

The CVSS score of 9.3 indicates a high‑severity risk, and while the EPSS score is not available, the lack of KEV listing does not reduce the potential impact. Attackers can exploit the flaw by submitting malicious input through any exposed form, and the stored payload only requires a victim to view the compromised page. Because the scope is changed, a successful exploit could provide the attacker with the same level of access as the victim.