Adobe Experience Manager EUVD-2026-100527

Exploitation requires an authenticated, low-privileged Adobe Experience Manager session (PR:L) on an affected version - AEM 6.5 through 6.5.25 or AEM 6.5 LTS through SP3 per EUVD - reachable over the network (AV:N). The specific vulnerable feature or endpoint is not named in the description or the referenced APSB26-152 advisory summary, so the exact injectable parameter should be confirmed with Adobe. No user interaction is needed (UI:N) and attack complexity is low (AC:L); the primary limiting factor is the need for valid low-privilege credentials, which constrains fully anonymous internet exploitation but is a low bar in multi-user AEM author environments. The changed scope (S:C) means the injected OS command executes outside the application's security authority, affecting the host system.

This is a genuine high-priority vulnerability, not a CVSS-inflated paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity OS command injection (CWE-78) that only requires a low-privileged account and no user interaction, with a changed scope and High impact across confidentiality, integrity, and availability - yielding the 9.9 score and a path to arbitrary code execution in the context of the current user. The authentication qualifier is supported by the vector: PR:L confirms an authenticated but low-privileged attacker, which modestly limits exposure versus a fully unauthenticated flaw, yet AEM deployments frequently provision many low-privilege author/content accounts, so this barrier is weak in practice. Signals are not in conflict but several are simply absent: no EPSS probability, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of EPSS/KEV/POC should not be read as 'low risk' - it reflects missing telemetry, not confirmed quiet, and the Adobe PSIRT report plus network-exploitable RCE on a widely deployed enterprise CMS make this a strong patch priority. No SSVC decision data was supplied; technical impact is clearly 'total' given full C/I/A loss, but automatable/exploitation status cannot be determined from the input.

An attacker who holds or obtains a low-privileged Adobe Experience Manager account (e.g., a content author) sends a crafted request to a vulnerable AEM endpoint that passes attacker-controlled input into an OS command without proper neutralization. Because no user interaction is needed and scope is changed, the injected command executes on the underlying host and can reach resources beyond the application's own security authority. No public exploit code was identified at time of analysis, so exploitation currently requires original development.