Adobe Campaign Classic CVE-2026-104353

Exploitation requires a network path to the Adobe Campaign Classic application plus a low-privilege authenticated account (CVSS PR:L), and no user interaction (UI:N). Affected deployments are Adobe Campaign Classic up to and including 7.4.4 build 9402 (per EUVD). The specific vulnerable feature, protocol, or configuration that carries the OS command injection is not described in the available sources, so it cannot be narrowed further. The main limiting factor is the authentication requirement - an attacker must first possess or obtain valid low-privilege credentials; it is not exploitable fully unauthenticated based on the provided CVSS vector.

Multiple signals converge on high priority despite incomplete data. The CVSS 3.1 base score is 9.9 (Critical) with vector AV:N/AC:L/PR:L/UI:N/S:C, meaning network-reachable, low-complexity exploitation that needs only low-privilege access, no user interaction, and crosses a scope boundary (code execution in the OS context from an application-level foothold). CWE-78 OS command injection leading to arbitrary code execution is a high-impact class. The vuln.today Decision label is act_now, and the issue was reported by the vendor (Adobe) via advisory APSB26-162, so the existence and severity are vendor-confirmed. Signals that are ABSENT rather than negative: there is no CISA KEV listing, no EPSS probability supplied, and no public PoC or exploit reference in the input - so I cannot claim active or probable exploitation. The act_now label therefore rests on intrinsic severity and vendor confirmation, not on observed exploitation. Net: this is a genuine high-priority patch item for ACC operators because of the low attack complexity, low privilege requirement, scope change, and full CIA impact - but there is no evidence of in-the-wild or public exploitation at time of analysis, so urgency is driven by potential rather than confirmed attacker activity.

An attacker who already holds a low-privilege authenticated account on an Adobe Campaign Classic instance sends a crafted request that injects operating-system commands into a component that fails to neutralize special shell elements. The injected command runs in the context of the current user and, because scope is changed, yields arbitrary code execution beyond the application boundary. No user interaction is required; the exact feature that is vulnerable is not described in the available sources, and no public PoC is referenced.