The vulnerability originates from an improper input validation flaw in Adobe Experience Manager Forms JEE. Attackers possessing high privileges can supply specially crafted input that the system accepts and executes, enabling arbitrary code execution in the context of the compromised user. The flaw changes scope, allowing execution without requiring any user interaction.

Adobe Experience Manager 6.5 Forms JEE and the Adobe Experience Manager 6.5 LTS Forms JEE are affected.

This issue carries a CVSS score of 9.1, indicating critical severity, but the EPSS score is 1%. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker with sufficient privileges can exploit the vulnerability by submitting malicious data to the form endpoints, and the altered scope permits the attacker to execute code under the account of the authenticated user. The absence of user interaction suggests that the vulnerability can be triggered from a single HTTP request containing the malformed input.