EUVD-2026-56840
GHSA-jrx4-5gm3-vcqr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ACC v7 server over network
-
DeliverySend crafted request bypassing authorization
-
ExploitTrigger code execution as current user
-
ExecutionLeverage changed scope to affect adjacent resources
-
ImpactAccess or exfiltrate campaign/customer data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against Adobe Campaign Classic v7 (ACC v7) instances running 7.4.3 build 9399 or earlier, per CVSS AV:N/AC:L/PR:N/UI:N with no required user interaction. The practical limiting factor is network reachability of the ACC application/delivery server: the attacker must be able to connect to the vulnerable service, so instances that are not exposed beyond a trusted network are harder to reach. Only ACC v7 builds up to 7.4.3 build 9399 are in scope; 7.4.4 build 9400 and later are not affected. |
| Impact | This is a genuine top-priority issue rather than a high-score-but-low-real-risk case: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and total confidentiality, integrity, and availability loss across a changed scope - the maximum 10.0. The mitigating signal is exploitation maturity: there is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied, so widespread automated attack is not yet evidenced. Given an unauthenticated network RCE in an enterprise marketing platform that often handles large volumes of customer PII, any operator - from a large brand to a mid-sized municipal IT team running a single ACC instance - should treat patching as urgent and not wait for a public proof-of-concept to appear. The absence of EPSS/KEV data reflects a lack of observed exploitation, not lower inherent exploitability; the technical barrier to exploitation is low. |
| Exploit ScenarioDerived | An attacker who can reach an ACC v7 server over the network sends a crafted request that abuses the incorrect authorization check to bypass authentication and invoke functionality that executes code in the context of the current user. Because no user interaction is required and attack complexity is low, this can be automated against exposed instances; with scope changed, the attacker may then pivot to affect resources beyond the initial component. No public proof-of-concept is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Arbitrary code execution in Adobe Campaign Classic (ACC v7 through 7.4.3 build 9399) stems from an incorrect authorization flaw that lets a remote attacker bypass authentication and run code in the context of the current user. Adobe's PSIRT rates it CVSS 10.0 with a changed scope, meaning a successful attack can impact resources beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical but the severity is maximal.
RemediationAI
Vendor-released patch: upgrade Adobe Campaign Classic v7 to 7.4.4 build 9400, which remediates the incorrect authorization flaw, per Adobe bulletin APSB26-123 (https://helpx.adobe.com/security/products/campaign/apsb26-123.html). Apply this update as the primary and definitive fix. Until the patch can be deployed, reduce exposure by restricting network access to the ACC application and delivery servers - place them behind a VPN or IP allowlist and remove any unnecessary internet exposure of administrative and API endpoints - accepting the trade-off that this may disrupt legitimate remote operator or integration access; also increase monitoring of authentication and authorization logs for anomalous access to privileged functionality. These are compensating controls only; because the flaw is an authorization bypass reachable over the network, network-level restriction limits the attacker population but does not eliminate risk from any actor who can already reach the server.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Campaign Classic is an on-premise/hybrid enterprise marketing automation and cross-channel campaign management platform, typically deployed with internet-facing application and delivery servers. The root cause is CWE-863 (Incorrect Authorization): the application performs an authorization check but does so incorrectly, allowing an actor to reach functionality or data they should not be permitted to use. Combined with the tagged 'Authentication Bypass' behavior, the flawed authorization path can be leveraged to reach code-execution functionality without valid credentials, and the CVSS scope change (S:C) indicates the executing code can affect components outside the vulnerable module's security authority.
Know when Campaign gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable authorization bypass yielding code execution (AV:N/AC:L/PR:N/UI:N) with full CIA loss and a changed scope (S:C) per Adobe's described impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
Executive ViewAI
Adobe Campaign Classic v7 through version 7.4.3 (build 9399) contains a critical authentication bypass vulnerability (CVE-2026-71398, CVSS 10.0) enabling arbitrary code execution. Organizations using ACC for marketing automation face immediate risk of system compromise, with potential impact on connected infrastructure and sensitive customer/campaign data. Leadership must immediately implement access restrictions and heightened monitoring, as no vendor patch currently exists and an attacker with network access could achieve full server takeover.
Implement strict network segmentation restricting ACC instance access to authenticated internal networks only; deploy network intrusion detection/prevention systems to monitor for exploitation attempts; enable comprehensive audit logging of all ACC access, administrative actions, and code execution activity; disable unnecessary remote access features and enforce multi-factor authentication for all administrative ACC access; consider temporary offline status for ACC v7 instances if business continuity permits; monitor official Adobe security advisories daily for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
OS command injection in Adobe Campaign Classic (ACC) versions up to and including 7.4.4 build 9401 allows attackers to e
Arbitrary code execution in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 lets a remote, unauthenticated atta
Remote code execution in Adobe Campaign Classic (ACC) version 7.4.3 build 9394 and earlier allows unauthenticated networ
Server-side request forgery in Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier escalates to arbitrary
Arbitrary code execution in Adobe Campaign Classic (ACC) versions 7.4.3 build 9397 and earlier stems from an incorrect a
Adobe Campaign versions Build 8770 and earlier have an input validation bypass that could be exploited to read, write, o
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Rated critical
Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability. Rated critical severity (CVSS 9
SQL injection in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 allows a remote attacker to inject crafted SQL
Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary fi
IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating
Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arb
Exploit-DB