This vulnerability (CWE-863) in Adobe Experience Manager as a Cloud Service involves incorrect authorization checks that permit a low-privileged attacker to escalate privileges and execute arbitrary code in the context of the victim's session. The attack does not require user interaction and changes the security scope, enabling potentially full control over the victim's account or session. The CVSS v3.1 score is 9.9 (critical), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity, and availability. No remediation or patch details are currently available.

Successful exploitation can result in arbitrary code execution with elevated privileges, leading to full compromise of the victim's account or session, including confidentiality, integrity, and availability impacts. The vulnerability can be exploited remotely without user interaction by a low-privileged attacker, significantly increasing risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Monitor Adobe's official security advisories for updates and apply patches promptly once available.