EUVD-2026-52515
GHSA-9pj6-9m2w-cqcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ACC application endpoint
-
DeliverySubmit crafted SQL injection payload
-
ExploitManipulate backend database query
-
ExecutionEscalate to arbitrary code execution
-
ImpactAccess PII and control application
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation is possible against reachable Adobe Campaign Classic instances, since the CVSS vector is AV:N/AC:L/PR:N/UI:N and the description explicitly states exploitation does not require user interaction. The practical limiting factor is network reachability of the ACC application/delivery interface: instances exposed to the internet or to a broad internal network are directly at risk, whereas deployments that restrict the console and delivery endpoints to a management VLAN or VPN materially raise the bar. The exact vulnerable endpoint/parameter and any version-specific gating are not detailed in the provided input and must be confirmed via Adobe advisory APSB26-120. |
| Impact | This is a genuine top-tier priority, not an inflated high-CVSS-but-low-real-risk item. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields the maximum 10.0: remotely reachable, low complexity, no authentication, no user interaction, scope change, and full CIA impact. No EPSS score was supplied in the input, so exploitation-probability modeling cannot be quantified here, and no SSVC decision data was provided. The vulnerability is NOT in CISA KEV and no public POC was referenced, so exploitation is not confirmed in the wild; the risk therefore rests on the intrinsic characteristics rather than observed activity. The combination of unauthenticated network access plus SQLi-to-RCE on a marketing platform holding large volumes of PII makes this attractive for opportunistic and targeted attackers alike once details or a POC emerge. No key CVSS/description conflict is present - description ('does not require user interaction', 'arbitrary SQL', 'scope changed') aligns cleanly with the vector. |
| Exploit ScenarioDerived | An attacker who can reach the ACC application over the network sends a crafted request containing malicious SQL to a vulnerable, unauthenticated input parameter; the injected query executes against the campaign database, letting the attacker read or alter recipient/campaign data and pivot to arbitrary code execution in the application's user context. Because no authentication or user interaction is required, this can be attempted directly against an exposed instance; no public POC was referenced at time of analysis, so exploitation would currently require the attacker to independently develop the injection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that escalate to arbitrary code execution in the context of the current user, per Adobe advisory APSB26-120. The CVSS 3.1 base score is a maximum 10.0 with a changed scope, reflecting network reachability, no privileges, no user interaction, and full confidentiality/integrity/availability impact spilling into adjacent components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum severity and unauthenticated network vector make this a top-priority patch.
RemediationAI
Apply the update referenced in Adobe's security bulletin APSB26-120 (https://helpx.adobe.com/security/products/campaign/apsb26-120.html) as the primary fix; treat this as 'Patch available per vendor advisory' because the input does not include an exact fixed version number, so the specific build must be taken directly from that advisory and applied to the matching ACC branch. Until the patch is deployed, reduce exposure by restricting network reachability of the ACC web/application and delivery interfaces to trusted management networks or VPN only, placing a WAF in front of the console with SQL-injection signatures enabled (accepting that WAF rules can be bypassed and may false-positive on legitimate campaign payloads), and tightening the database account used by ACC to least privilege to blunt the escalation to code execution (note this can break workflows that rely on elevated DB rights, so validate in staging). Increase monitoring of database query logs and application access logs for anomalous SQL patterns as a detective control while the patch is scheduled.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-89 Improper Neutralization of Special Elements used in an SQL Command, meaning user-controllable input reaches a database query without adequate parameterization or escaping. The affected product (cpe:2.3:a:adobe:adobe_campaign_classic) is Adobe's on-premise/hybrid enterprise campaign-orchestration and marketing-automation platform, which stores recipient, campaign, and workflow data in a backing SQL database (typically PostgreSQL, Oracle, or MS SQL). Because ACC exposes web-facing application and delivery interfaces backed directly by this database, an injection point allows an attacker to manipulate query logic; the advisory and CWE chain indicate the injection is leveraged beyond data theft into code execution in the application's execution context, and the changed scope (S:C) signals the impact crosses the vulnerable database/authorization boundary into other components.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network SQLi with no user interaction (AV:N/AC:L/PR:N/UI:N); escalation to code execution beyond the DB boundary justifies S:C and full C/I/A high impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the application. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe Campaign Classic users face critical risk from a remote code execution vulnerability (CVE-2026-48330, CVSS 10.0) requiring no authentication or user interaction to exploit. Successful attacks could grant adversaries complete access to customer data, campaign databases, and underlying infrastructure, enabling data theft, service disruption, or lateral movement. Immediate mitigation measures are essential until Adobe releases a security patch.
No vendor-released patch identified at time of analysis. Interim controls: restrict external network access to ACC systems using firewall rules and network segmentation, deploy WAF rules targeting common SQL injection signatures, disable external API access if operationally feasible, implement real-time alerting on abnormal SQL query patterns and failed authentication attempts, rotate all ACC service and administrative credentials immediately, require multi-factor authentication for all ACC administrative console access, and establish daily security log review procedures. These mitigations reduce attack surface but do not eliminate vulnerability risk until patch deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Exploit-DB