EUVD-2026-52518
GHSA-rxfg-j664-gqpp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and low-complexity, but privilege escalation implies a starting account, so PR:L rather than PR:N; full C/I/A impact from admin-level takeover.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated privileges. Exploitation of this issue does not require user interaction.
AnalysisAI
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an attacker gain elevated privileges without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 Critical, implying a network-reachable, low-complexity path to full compromise of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker requires network reachability to the Adobe Campaign Classic application (AV:N) and, per the CVSS vector, no authentication (PR:N) and no user interaction (UI:N), with low attack complexity (AC:L) - implying exploitation against a reachable ACC instance without special configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are partly conflicting and should be treated with caution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the ACC application over the network sends a crafted request that the platform incorrectly authorizes, causing it to grant privileges beyond the attacker's intended role and yielding administrative control over campaigns and the underlying customer data. Because the CVSS vector specifies UI:N and AC:L, no victim interaction or elaborate conditions are needed once the endpoint is reachable. … |
| Remediation | Apply the fix described in Adobe security bulletin APSB26-120 (https://helpx.adobe.com/security/products/campaign/apsb26-120.html); the exact patched version is not provided in this input, so consult the advisory for the precise build and follow Adobe's stated priority rating and installation guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all Adobe Campaign Classic instances in your environment and immediately restrict network access to ACC administrative interfaces using firewall rules, network segmentation, or VPN-only policies; enable detailed audit logging of all administrative actions simultaneously. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing c
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code
Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives in
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today