EUVD-2026-40337
GHSA-f44v-356v-7qcf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ACC endpoint over network
-
DeliverySend crafted request bypassing authorization check
-
ExploitInvoke privileged server-side functionality
-
ExecutionExecute arbitrary code as ACC service
-
ImpactPivot across changed scope to host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Adobe Campaign Classic version 7.4.3 build 9396 and earlier, per the CVSS vector AV:N/AC:L/PR:N/UI:N and the description's explicit note that exploitation does not require user interaction. The primary limiting factor is network reachability of the ACC application/API endpoints: deployments where these interfaces are not exposed to untrusted networks (segmented, VPN-gated, or IP-allowlisted) materially reduce real-world exploitability. The only hard version constraint is that the instance must be at or below 7.4.3 build 9396. |
| Impact | All available severity signals point to top-tier priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H scores a maximum 10.0, indicating network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full confidentiality, integrity and availability impact across a changed scope. The vulnerability is reported directly by Adobe (the vendor), increasing confidence in the affected-version and impact data. However, exploitation-likelihood signals are notably absent or unprovided: no EPSS score was supplied, the issue is not in CISA KEV, no SSVC decision data was given, and no public proof-of-concept is referenced. This means the technical severity is confirmed-critical, but real-world exploitation evidence is currently limited to none - a high-CVSS issue that warrants urgent patching on exposure grounds rather than confirmed active-attack grounds. The 'in the context of the current user' wording in the description is worth verifying against the PR:N vector, since the privilege level of resulting code execution depends on the service account ACC runs under. |
| Exploit ScenarioDerived | An attacker with network reachability to an internet-exposed Adobe Campaign Classic server sends crafted requests to a privileged endpoint, abusing the incorrect authorization check to invoke functionality that should require authentication. Because no credentials and no user interaction are needed, the attacker chains the bypass into arbitrary code execution in the context of the ACC service, gaining a foothold on the host. No public proof-of-concept is currently referenced, so this scenario is inferred from the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the stated RCE impact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 30, 2026
Remote code execution in Adobe Campaign Classic (ACC) version 7.4.3 build 9396 and earlier allows unauthenticated attackers to bypass authorization controls and run arbitrary code in the context of the current user. The flaw stems from an incorrect authorization check (CWE-863) reachable over the network with no user interaction, and the changed scope means impact can extend beyond the vulnerable component. It carries a maximum CVSS 10.0 rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory: upgrade Adobe Campaign Classic to the fixed release identified in Adobe Security Bulletin APSB26-69 (https://helpx.adobe.com/security/products/campaign/apsb26-69.html), as builds at or below 7.4.3 build 9396 are vulnerable; the exact patched build should be confirmed directly from that bulletin before deployment as a specific fix version was not included in the provided data. Until the upgrade is applied, reduce exposure by restricting network access to the Adobe Campaign application and API endpoints - place the server behind a VPN or IP allowlist and block direct internet access to the management/SOAP interfaces, accepting that this may disrupt remote operators or integrated external channels that legitimately call those endpoints. Monitor application and web-server logs for anomalous authorization-bypass patterns and unexpected code-execution or process-spawn activity from the ACC service account as a detective control while patching is scheduled.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Campaign Classic is an on-premises/hybrid marketing automation and cross-channel campaign management platform that exposes web-facing application server endpoints and a SOAP/HTTP API. The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning an authorization decision is performed but uses a flawed check, allowing an action to proceed when it should be denied. Per the CPE (cpe:2.3:a:adobe:adobe_campaign_classic_(acc):*) this affects the Adobe Campaign Classic application across versions up to and including 7.4.3 build 9396. Combined with the 'arbitrary code execution' outcome and a changed CVSS scope (S:C), the broken authorization likely permits an attacker to reach privileged server-side functionality that can execute code, with consequences crossing the original security boundary (e.g., from the application layer into the underlying host or adjacent components).
Know when Adobe Campaign Classic Acc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable authorization bypass needing no auth or interaction yields PR:N/UI:N/AC:L, and code execution crossing the component boundary justifies S:C with full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
Executive ViewAI
Adobe Campaign Classic versions 7.4.3 build 9396 and earlier contain a critical remote code execution vulnerability allowing unauthenticated attackers to bypass authorization controls and execute arbitrary code on affected systems. With no vendor-released patch identified at time of analysis and no public exploit identified, organizations running affected versions face urgent risk of system compromise. Immediate network-level controls are required to prevent unauthorized access until a patch becomes available.
Network segmentation restricting ACC access to trusted networks; Web Application Firewall rules targeting authorization-bypass patterns (CWE-863); Enhanced real-time monitoring and alerting for authentication and authorization events; Logging and monitoring for suspicious outbound connections from ACC infrastructure; Air-gapping or VPN-gating of ACC systems from external networks; Principle of least privilege enforcement limiting ACC administrative access to minimum required personnel; Network intrusion detection system monitoring for exploitation attempts targeting the authorization flaw.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB