The vulnerability is an Incorrect Authorization flaw that allows an attacker to execute arbitrary code in the context of a legitimate user account. Because the issue is not user‑interaction dependent, exploitation can occur without prompting the victim, and the scope is changed, meaning that any privileges granted to the affected user can be leveraged to gain elevated control over the application or the underlying system.

Adobe Experience Manager 6.5, Adobe Experience Manager 6.5 LTS and Adobe Experience Manager as a Cloud Service. No further version granularity is provided beyond the product lines noted by Adobe.

The CVSS score is 10, indicating a critical severity, and the EPSS score is not available, so the exploitation likelihood cannot be quantified but remains high given the scope change and lack of user interaction. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the web application or any authenticated session to the Experience Manager console, where exclusive authorization checks are bypassed due to the flaw.