Adobe Campaign Classic CVE-2026-104350

Exploitation requires a victim who is an authenticated Adobe Campaign Classic user to actively click an attacker-crafted URL or interact with a compromised page (UI:R) - the reflected payload is not persisted, so each target must be lured individually. The attacker needs no credentials or privileges on the server (PR:N) and no special ACC configuration is named in the description as a precondition. The specific vulnerable parameter, endpoint, or feature that reflects the input is NOT described in the available sources. Affected deployments are those running Adobe Campaign Classic version 7.4.4 build 9402 or earlier; this is the primary limiting factor alongside the mandatory user interaction and the requirement that the lured user hold a meaningful ACC session for account/session takeover to have impact.

This is a genuine priority, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated reflected XSS whose changed scope (S:C) reflects script execution in the victim's authenticated session context rather than the server itself, driving the 9.3 (Critical) score. The vuln.today decision label is act_now and the issue was reported by Adobe itself via advisory APSB26-162, so vendor confirmation of the defect is strong. However, several exploitation-pressure signals are MISSING from the input: no EPSS probability is provided, the issue is NOT listed in CISA KEV, and no PoC or exploit reference is supplied - so there is no public exploit identified at time of analysis. The one tension to flag explicitly: the CVSS unauthenticated/low-complexity profile makes this look like a mass-exploitable flaw, but reflected XSS inherently requires per-victim social engineering (UI:R), so real-world abuse is targeted/phishing-driven rather than wormable despite the Critical rating. Treat the act_now label as the controlling urgency signal while recognizing that, absent EPSS/KEV/PoC data, widespread automated exploitation is not currently evidenced.

An attacker crafts a malicious URL targeting the vulnerable Adobe Campaign Classic parameter and delivers it to a logged-in ACC operator via phishing or a compromised page. When the victim clicks it, attacker-controlled script executes in their authenticated session context, letting the attacker hijack the session or act with the victim's privileges. No public exploit was identified in the provided data, so this scenario is inferred from the reflected-XSS mechanism and the UI:R requirement.