Adobe Experience Manager is affected by an incorrect authorization flaw that lets an attacker run arbitrary code in the context of the user who initiates the request. The vulnerability can be used to elevate privileges, gain control over the victim’s account or session and the exploit does not need user interaction. The flaw changes application scope, allowing the attacker to execute code with the privileges of the authenticated user or higher.

Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and Adobe Experience Manager as a Cloud Service are all affected. No additional sub‑version detail is provided beyond these product lines.

The CVSS score of 10 marks this issue as critical, yet no EPSS data is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, involving crafted requests to the AEM web interface or APIs, and the flaw functions without any user interaction. Because the vulnerability changes the application scope, a successful exploit can run code with the privileges of the user who caused it or potentially higher.