Adobe Experience Manager EUVD-2026-100529

Exploitation requires a valid low-privilege authenticated account or session on the target Adobe Experience Manager 6.5 instance (CVSS PR:L) - it is NOT reachable by fully unauthenticated attackers from the provided vector. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once authenticated the attacker can trigger the flaw by sending improperly-validated input over the network (AV:N). The description does not name a specific feature or non-default configuration, implying default installations of AEM 6.5 up to and including 6.5.25 are affected; the primary limiting factors are therefore the authentication requirement and network exposure of the AEM author/publish instance. Affected versions are AEM 6.5 through 6.5.25; upgrading per Adobe APSB26-152 removes the condition.

This is a genuine high priority, not a CVSS-inflated artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) and no user interaction, yielding arbitrary code execution with a changed scope - meaning the attacker can break out of the vulnerable component's security boundary. The CWE-20 Improper Input Validation root cause combined with AEM's typical deployment (internet-facing author/publish instances) makes this attractive to attackers. However, several signals are MISSING and must not be presented as present: no EPSS exploitation-probability score was supplied, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept was provided - so there is no public exploit identified at time of analysis. The one practical limiter is PR:L: an attacker needs some valid (even low-privilege) account or session, so default-deny access controls and restricting the author instance from the public internet materially reduce real-world risk. Net: treat as high-priority patching given the 9.9 score, RCE impact and scope change, while recognizing exploitation currently appears theoretical rather than confirmed in the wild.

An attacker holding a low-privilege authenticated account (or a stolen/low-trust session) on an Adobe Experience Manager 6.5 instance submits crafted, improperly-validated input to a vulnerable endpoint, triggering arbitrary code execution in the context of the current user and, because scope is changed, pivoting to resources beyond the originally authorized boundary. No user interaction is required (UI:N) and attack complexity is low (AC:L). No public exploit code has been identified at the time of analysis.