EUVD-2026-52515
GHSA-9pj6-9m2w-cqcg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network SQLi with no user interaction (AV:N/AC:L/PR:N/UI:N); escalation to code execution beyond the DB boundary justifies S:C and full C/I/A high impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the application. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that escalate to arbitrary code execution in the context of the current user, per Adobe advisory APSB26-120. The CVSS 3.1 base score is a maximum 10.0 with a changed scope, reflecting network reachability, no privileges, no user interaction, and full confidentiality/integrity/availability impact spilling into adjacent components. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation is possible against reachable Adobe Campaign Classic instances, since the CVSS vector is AV:N/AC:L/PR:N/UI:N and the description explicitly states exploitation does not require user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-tier priority, not an inflated high-CVSS-but-low-real-risk item. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the ACC application over the network sends a crafted request containing malicious SQL to a vulnerable, unauthenticated input parameter; the injected query executes against the campaign database, letting the attacker read or alter recipient/campaign data and pivot to arbitrary code execution in the application's user context. Because no authentication or user interaction is required, this can be attempted directly against an exposed instance; no public POC was referenced at time of analysis, so exploitation would currently require the attacker to independently develop the injection. |
| Remediation | Apply the update referenced in Adobe's security bulletin APSB26-120 (https://helpx.adobe.com/security/products/campaign/apsb26-120.html) as the primary fix; treat this as 'Patch available per vendor advisory' because the input does not include an exact fixed version number, so the specific build must be taken directly from that advisory and applied to the matching ACC branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Adobe Campaign Classic instances in production and non-production environments, implement network access controls restricting ACC connectivity to trusted internal networks only, and enable comprehensive transaction and query logging on all ACC systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing c
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an a
Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives in
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today