EUVD-2026-52513
GHSA-wcfj-69rh-85w5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable API needs a low-privileged account (PR:L) with no user interaction; SQLi-to-RCE gives full C/I/A and crosses a boundary, so S:C.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
AnalysisAI
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code in the context of the current user without any user interaction. Because unsanitized input reaches an SQL command (CWE-89), an attacker with minimal access can pivot from database manipulation to code execution, and the CVSS scope change (S:C) indicates the impact extends beyond the vulnerable component itself. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to first hold low-privileged authenticated access to Adobe Campaign Classic (CVSS PR:L) - for example any valid ACC operator login or an application/API credential - and network reachability to the vulnerable ACC application server endpoint that constructs the SQL command. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high priority, not an inflated high-CVSS artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained any low-privileged Adobe Campaign Classic account or operator/API credential sends crafted input to a network-reachable ACC endpoint whose query is built with unsanitized parameters. The injected SQL manipulates the backing database and is chained to reach arbitrary code execution in the current user's context, crossing into resources outside the original component (scope change). … |
| Remediation | Apply the update published in Adobe Security Bulletin APSB26-120 (https://helpx.adobe.com/security/products/campaign/apsb26-120.html); the input does not include an exact fix version, so treat this as 'Patch available per vendor advisory' and confirm the precise patched build from that bulletin for your ACC branch before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Adobe Campaign Classic instances and assess internal user populations with platform access; immediately enable enhanced logging and monitoring for SQL error messages and unusual query patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing c
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an a
Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives in
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today