Adobe Campaign Classic CVE-2026-48323

The prerequisite is an ACC input path that flows into the server-side template engine - a personalization field, delivery/message body, or workflow expression that accepts attacker-influenced content which the engine then evaluates (CWE-1336 SSTI). The CVSS vector states AV:N/AC:L/PR:N/UI:N, so no user interaction is required and, per the vector, no privileges; however, the description's phrase 'arbitrary code execution in the context of the current user' suggests execution occurs within an existing user/operator session context, which is a limiting factor worth confirming against APSB26-120. Practical limits on exploitation: network reachability of the affected ACC component (instances restricted to internal management networks are less exposed), the specific vulnerable version range enumerated by Adobe, and whether the injectable template-driven feature is exposed to the attacker's input in a given deployment.

This is a genuine top-priority issue rather than a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is the maximum 10.0: network-reachable, low attack complexity, no privileges, no user interaction, changed scope, and total confidentiality/integrity/availability loss. SSTI-to-RCE flaws are typically automatable and carry total technical impact, which aligns with an aggressive SSVC posture. The counterweight is exploitation-signal data: it is not in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis and no EPSS score was provided in the input. That absence should not be read as low risk - Adobe Campaign is an attractive, marketing-data-rich target and a scope-changed unauthenticated RCE tends to attract exploit development quickly once details circulate. Note one point to verify with the vendor: the description says code executes 'in the context of the current user,' which implies some existing session/operator context, yet the CVSS vector asserts PR:N (no privileges); this apparent tension between the prose and the vector should be confirmed against APSB26-120.

An attacker reaches an Adobe Campaign Classic endpoint that feeds attacker-influenced data into a personalization or delivery template and submits input containing template-engine syntax instead of plain data. The engine evaluates the injected expression, breaking out of the data context to run arbitrary code on the server in the current user's context, giving the attacker a foothold in the marketing platform and its data. No public POC is referenced, but the low-complexity, no-interaction network vector makes reliable exploitation straightforward once the injection point is known.