Adobe Experience Manager is vulnerable to an Improper Restriction of XML External Entity Reference, allowing a low‑privileged attacker to gain elevated access to internal resources. The vulnerability is a classic XXE flaw that can read arbitrary files or request external network resources, with the exposed scope change indicating that the impact can extend beyond the originally intended boundaries of the application.

Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS, and Adobe Experience Manager as a Cloud Service are affected. No additional specific version details are listed; users should verify the exact build of their deployed instance against the Adobe advisory.

The CVSS score of 9.6 signals a critical level of risk. The EPSS score is not available, so the current public estimate of exploitation probability cannot be calculated, but the lack of a user interaction requirement and the scope change suggest that the vulnerability can be leveraged remotely through XML processing of application input. The issue is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet, but the high severity warrants immediate attention.