Adobe Experience Manager is susceptible to an XML injection flaw that allows an attacker with low privileges to inject malformed XPath expressions. This blind injection can bypass the system's security controls, granting the attacker unauthorized read access and limited write capabilities within the application. The flaw does not require any user interaction, making exploitation straightforward once the vulnerable endpoint is exposed.

The vulnerability impacts Adobe Experience Manager version 6.5. No other versions are explicitly listed in the CNA data, and the advisory specifically addresses the 6.5 release.

The CVSS score of 7.1 indicates a moderate to high severity, while the absence of an EPSS value means the current probability of exploitation is unclear. Based on the description, it is inferred that the attack can be launched without user involvement, and the likely attack vector is remote injection against exposed XML processing endpoints. The vulnerability is not yet cataloged in the CISA KEV catalog, suggesting that widespread exploitation has not been reported, but the moderate severity and remote nature warrant prompt remediation.