EUVD-2026-111229
GHSA-rp3v-m642-6g4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged ACC account
-
DeliverySend crafted request bypassing authorization check
-
ExploitReach restricted code-execution functionality
-
ExecutionExecute arbitrary code as current user
-
ImpactLeverage changed scope to impact broader resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged account on a network-reachable Adobe Campaign Classic instance (CVSS PR:L) - the attacker must already be authenticated at a low privilege level, which is the primary limiting factor. No user interaction is required (UI:N) and the attack is low-complexity (AC:L), so once a low-priv foothold exists, exploitation is straightforward against affected versions (0 through 7.4.4 build 9402). The available sources do not describe the exact feature, endpoint, or configuration that triggers the incorrect authorization, so the precise trigger is not described in the available sources; exposure is bounded by whether the ACC instance is reachable by the attacker and whether low-privilege accounts are provisioned. |
| Impact | This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity flaw needing only low privileges and no user interaction, with a changed scope and full C:H/I:H/A:H impact - consistent with incorrect authorization (CWE-863) leading to arbitrary code execution. The vuln.today decision label is 'act_now', reinforcing urgency. However, key exploitation signals are absent: no EPSS probability is provided, there is no CISA KEV listing, and no public exploit or PoC reference appears in the input (references are vendor/NVD advisories only) - so this is 'no public exploit identified at time of analysis'. The score is vendor-assigned (reported by Adobe) and not independently corroborated by NVD analysis in the supplied data. Net: the severity and act_now label justify prioritized patching, but the lack of EPSS/KEV/PoC means active or widespread exploitation is NOT established - treat as a high-severity, pre-exploitation priority rather than a confirmed in-the-wild threat. |
| Exploit ScenarioDerived | An attacker who holds a low-privileged account on an exposed Adobe Campaign Classic instance sends crafted requests that bypass authorization checks, reaching functionality they should not be allowed to invoke. Because scope is changed and the flaw yields arbitrary code execution, the attacker runs code in the context of the current user without any user interaction. No public exploit code is identified in the available data, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Arbitrary code execution in Adobe Campaign Classic (versions 0 through 7.4.4 build 9402) stems from incorrect authorization that lets a low-privileged, authenticated attacker run code in the context of the current user, with no user interaction required. The CVSS 9.9 score reflects a scope change (S:C), meaning the impact crosses a security boundary beyond the vulnerable component, and the only real prerequisite is a valid low-privilege account on a network-reachable ACC instance. No public exploit has been identified at time of analysis, but the issue carries an act_now priority, so exposure should be treated as urgent wherever ACC is reachable by untrusted networks or widely provisioned with low-privilege users.
RemediationAI
The supplied data does not specify a fixed build, so consult Adobe advisory APSB26-162 (https://www.adobe.com/trust/security/products/campaign/apsb26-162.html) for the patched version covering the 7.4.4 build 9402 and earlier range and apply it as the primary fix. Because exploitation requires only a valid low-privilege account, reduce exposure in the interim by restricting network access to ACC instances so only trusted administrative and integration networks can reach them - the trade-off is loss of remote access for legitimate campaign users and integrations, which must be re-routed through a controlled path. Audit and trim low-privilege account provisioning on internet-reachable instances, disabling or de-provisioning accounts that are not actively needed, accepting that this may interrupt existing campaign workflows for those users. No public exploit has been identified at time of analysis, but given the act_now priority and high severity, treat patch deployment and reachability reduction as time-sensitive on any ACC instance accessible from untrusted networks.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-863 (Incorrect Authorization): an authorization check in Adobe Campaign Classic does not correctly constrain what an authenticated low-privilege user is permitted to do, and the result is arbitrary code execution in the context of the current user. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - network reachable, low complexity, no user interaction, but requiring a valid low-privileged account (PR:L), which is the primary limiting factor. The S:C scope change indicates the vulnerable component and the impacted component are different security authorities, so code executing after the authorization failure is not confined to the privileges the low-privilege user should hold. ACC is an enterprise cross-channel campaign management platform typically deployed with multiple user roles and often reachable over a network or the internet; the available sources do not describe the exact feature, endpoint, or configuration that triggers the incorrect authorization, so the precise trigger is not described in the available sources.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Low-privileged authenticated attacker (PR:L) exploits over the network (AV:N) with no user interaction, achieving code execution with changed scope and full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorNVD
DescriptionNVD
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe Campaign Classic (versions up to 7.4.4 build 9402) contains a critical authorization flaw allowing any authenticated low-privilege user to execute arbitrary code without user interaction, potentially compromising the entire marketing platform and its integrated data. Given the scope change, this could serve as a pivot point into broader enterprise systems, making leadership attention essential to prevent data breaches or operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to ACC instances, enforcing MFA, auditing and minimizing low-privilege accounts, implementing network segmentation, and monitoring for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Exploit-DB