Adobe Experience Manager is vulnerable to an Incorrect Authorization flaw that allows an attacker to execute arbitrary code in the context of the current user, potentially leading to elevated privileges or full control of the victim's account. The flaw changes the scope so that code executed by a lower privileged user can affect higher privileged processes. No user interaction is needed to exploit the vulnerability.

The vulnerability affects Adobe Experience Manager versions 6.5 and 6.5 LTS. Any deployment of these product releases is impacted unless a patch has been applied.

The CVSS score of 9.9 indicates a critical severity, while the EPSS score is not available. It is not listed in the CISA KEV catalog. The attack vector is likely a network‑based request to the AEM server that bypasses authorization controls; the description infers that an attacker can submit crafted requests to authorized endpoints to trigger code execution. Given the scope change, the impact is system‑wide for compromised accounts.