Adobe Campaign Classic CVE-2026-48317

Exploitation requires a valid low-privileged authenticated ACC account (CVSS PR:L) with network reachability to the Adobe Campaign Classic application/API - it is NOT anonymously exploitable. The specific prerequisite is the ability to submit input into a feature that ACC dynamically evaluates as code (e.g., personalization/JSSP scripting, workflow activities, or expression-driven API calls); the CWE-95 eval-injection path is triggered by that dynamically evaluated input. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: an attacker without any ACC credentials cannot exploit this, and instances that restrict access to trusted networks and minimize server-side scripting exposure materially reduce reachability.

The signals lean toward genuine high priority but with a meaningful gating factor. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) shows network-reachable, low-complexity, no-user-interaction exploitation yielding high confidentiality and integrity impact with a scope change - hence 9.6 critical. The key limiter is PR:L: the attacker must already hold a low-privileged authenticated account, so this is not an anonymous internet-wide RCE. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified here. There is no CISA KEV entry and no POC in the provided data, so this is not confirmed to be under active exploitation. Notably the vendor set A:N (no availability impact), which is somewhat unusual for arbitrary code execution - code execution typically enables denial of service - so the availability rating may be conservative; verify against the Adobe advisory. Net: treat as a high-priority patch for internet-exposed or multi-tenant ACC instances where low-privileged accounts exist, but the authentication requirement reduces mass-exploitation risk relative to a PR:N flaw.

An attacker with a low-privileged ACC account crafts a personalization expression, workflow parameter, or API input containing injected script directives; when ACC dynamically evaluates that input server-side, the attacker's code executes in the context of the current user. Because scope is changed, the attacker can leverage this to affect resources beyond the initial component, potentially pivoting into campaign data or the hosting environment. No public exploit code is identified at time of analysis, but the low attack complexity makes weaponization straightforward once account access is obtained.