Adobe Campaign Classic CVE-2026-48399

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no special conditions are required beyond network reachability: no authentication, no special privileges, no user interaction, and no elevated attack complexity. This means any internet- or network-accessible Adobe Campaign Classic instance in its default state is susceptible. The vulnerability is bounded in scope: impact is limited to confidentiality (C:H) only - no write access (I:N) or availability disruption (A:N) is achievable through this flaw alone. Organizations with ACC deployed behind a corporate firewall or VPN with no external-facing exposure reduce realistic attacker reach substantially, though internal threat actors would still meet the exploitation prerequisites.

The CVSS 3.1 score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N represents a genuinely elevated real-world risk: the attack is network-reachable, requires no authentication or privileges, imposes no complexity barrier, and yields high confidentiality impact. The 'Authentication Bypass' tag from the CVE metadata directly aligns with the PR:N metric and CWE-657 classification, providing multi-source corroboration that no credentials are needed. No EPSS score was included in the provided intelligence, which limits probabilistic exploitation likelihood assessment. The vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified at time of analysis. The wildcard CPE scope suggests broad version coverage, amplifying urgency. Organizations with ACC exposed to internet-facing networks face the highest realistic risk; internal-only deployments are meaningfully less exposed. This is a high-priority patch target, not merely a high-CVSS-low-real-risk situation, given the PR:N and AC:L combination.

An unauthenticated attacker with network access to an Adobe Campaign Classic deployment sends a crafted HTTP request targeting an endpoint whose security control is bypassed due to the CWE-657 design flaw, obtaining read access to sensitive marketing data - potentially including subscriber PII, contact lists, or regulated personal data - without supplying valid credentials. The low attack complexity (AC:L) indicates no special preconditions or sequencing is required beyond network reachability, making this straightforward to exploit once the bypass vector is identified. No public proof-of-concept has been identified at time of analysis.