Adobe Experience Manager is affected by a Missing Authentication for Critical Function vulnerability (CWE-306) that allows an attacker to bypass security measures and gain unauthorized write access. The vulnerability changes the scope and does not require user interaction, meaning it can be exploited remotely without the need for the target to perform any action.

Known affected vendors and products include Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and Adobe Experience Manager as a Cloud Service. The CVE data does not specify affected versions, so version coverage is unknown.

The CVSS score of 8.6 classifies the issue as high severity, and the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA KEV, which limits current public exploit evidence. Based on the description, the likely attack vector is remote exploitation through the web interface or API that performs write operations, and the absence of user interaction suggests that an attacker can act from outside the trusted environment once the AEM instance is reachable.