EUVD-2026-50955
GHSA-hq36-26qm-2p5q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description confirms network-reachable, no-interaction, unauthenticated (PR:N) code execution with a changed scope and full CIA impact, matching a 10.0.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from an incorrect authorization flaw (CWE-863) that lets remote unauthenticated attackers run code in the context of the current user without any user interaction. The maximum CVSS 3.1 score of 10.0 reflects a network-reachable, no-privilege attack with a changed scope, meaning impact extends beyond the vulnerable component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions - remote unauthenticated exploitation with no user interaction against a network-reachable Adobe Campaign Classic instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue on paper: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes network-reachable, low-complexity, unauthenticated, no-interaction exploitation with full confidentiality, integrity, and availability impact and a scope change - the worst possible combination. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker with network access to an internet- or intranet-exposed Adobe Campaign Classic server sends a crafted request to an endpoint whose authorization check is implemented incorrectly, bypassing intended access controls without any credentials or user interaction. Leveraging the flawed authorization, the attacker reaches privileged functionality that executes code in the current user's context, achieving arbitrary code execution and, given the changed scope, impact on adjacent resources. … |
| Remediation | Apply the update referenced in Adobe security bulletin APSB26-114 (https://helpx.adobe.com/security/products/campaign/apsb26-114.html) as the primary fix; the exact patched build is not specified in the provided data, so obtain the fixed version and required build/gold-standard level directly from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Adobe Campaign Classic instances across the enterprise and implement immediate network segmentation to restrict ACC server accessibility to authorized administrative networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today