Adobe Experience Manager is vulnerable to an Improper Restriction of XML External Entity Reference that enables arbitrary code execution in the context of the current user. A low‑privileged attacker can deploy a crafted XML payload to trigger the parser, read sensitive files, and potentially gain elevated access or control over the victim’s account or session. The flaw does not require user interaction and the scope of the vulnerability has changed, indicating a possibility for privilege escalation.

Affected systems include Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and Adobe Experience Manager as a Cloud Service. No additional version details are provided beyond these releases.

The CVSS score of 9.6 marks this as a critical vulnerability, while the EPSS score of 2% indicates a low but non‑negligible probability of exploitation. It is not listed in CISA’s KEV catalog. The likely attack vector is remote; this is inferred from the description, as the attacker can send a specially crafted XML payload to a vulnerable component, triggering the external entity reference and executing code or obtaining data in the user’s context. Because the flaw does not require user interaction, it poses a significant risk to all exposed instances of the affected Adobe Experience Manager products.