Adobe Experience Manager is vulnerable to an Incorrect Authorization flaw (CWE-863) that enables an attacker to execute arbitrary code within the context of the authenticated user. The issue can lead to privilege escalation, allowing the attacker to gain elevated access or control over the victim's account or session without user interaction. The authority of the attack is broadened by a scope change, meaning the impact can extend beyond the compromised account to affect other resources.

The vulnerability affects Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and the Adobe Experience Manager as a Cloud Service. The affected versions are the releases listed by Adobe before they applied the security fix; no specific sub‑version is provided, so any instance of these products should be considered vulnerable until patched.

The flaw carries a CVSS score of 10, indicating maximum severity, and is listed in the CISA KEV catalog as not listed but still poses a critical threat. Because no user interaction is required, the attack vector is likely remote, exploiting the incorrect authorization logic inherent in the application. While the EPSS score is not available, the high CVSS and the scope‑changing nature of the flaw imply a significant risk of exploitation. Attackers may leverage compromised credentials or abuse authentication mechanisms to trigger code execution and gain elevated privileges.