Adobe Campaign Classic CVE-2026-48381

The core prerequisite is reachability of a vulnerable Adobe Campaign Classic v7 (≤ 7.4.3 build 9399) SQL query/API surface over the network. Exploitation does NOT require user interaction (UI:N). What LIMITS exploitation: Adobe explicitly states the 'exploit depends on conditions beyond the attacker's control,' reflected as high attack complexity (AC:H) - meaning environment- or timing-dependent, non-deterministic conditions must align for the injection to succeed. Additionally, the description references code execution 'in the context of the current user,' which suggests an existing user/session context may be involved despite the CVSS PR:N designation; authentication requirements are not conclusively confirmed from available data and should be verified with Adobe. Only ACC v7 builds up to 7.4.3 build 9399 are affected; 7.4.4 build 9400 and later are not.

Signals are mixed and must be weighed carefully. The CVSS 3.1 base score is 9.0 (critical) driven by AV:N, PR:N, UI:N, full C/I/A impact and a changed scope - implying remote, unauthenticated, high-consequence exploitation. However, AC:H materially lowers real-world exploitability, and Adobe explicitly states 'Exploit depends on conditions beyond the attacker's control,' signaling non-deterministic or environment-dependent exploitation rather than a trivially reliable RCE. No EPSS score, no POC, and no CISA KEV entry are present in the provided data, so there is currently no evidence of active exploitation or public weaponization. There is also tension worth verifying: the description says code execution 'in the context of the current user,' which hints at an existing user/session context, yet the CVSS vector asserts PR:N (unauthenticated) - verify authentication prerequisites with Adobe. Net: treat as a high-priority patch for internet-exposed or multi-tenant ACC instances given the critical rating and RCE potential, but the AC:H and absence of exploit evidence suggest it is not (yet) a mass-exploitation emergency.

An attacker with network access to an ACC v7 instance submits a crafted request to a vulnerable query or API parameter, injecting SQL that the application concatenates into a database statement without proper neutralization. By chaining the injection into the database/host execution context, the attacker triggers arbitrary code execution in the context of the current user - though the high attack complexity (AC:H) and Adobe's note that exploitation depends on external conditions mean success is not guaranteed on every attempt. No public proof-of-concept exploit is identified at time of analysis.