EUVD-2026-84659
GHSA-j75q-fm7g-j9hx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ACC endpoint over network
-
DeliverySend request bypassing authorization check (CWE-863)
-
ExploitTrigger arbitrary code execution as current user
-
ExecutionLeverage scope change to pivot to adjacent components
-
ImpactFull compromise of confidentiality, integrity and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions stated - the advisory describes remote unauthenticated exploitation (AV:N/PR:N) with no user interaction (UI:N) against Adobe Campaign Classic, implying default reachability of the affected functionality. Practical limiting factors: the ACC instance (or the vulnerable endpoint) must be network-reachable by the attacker, and code executes only in the context of the current application user rather than as root/SYSTEM. Exact affected versions and the fixed build are not enumerated in the provided reference and must be confirmed against APSB26-142. |
| Impact | This is a genuine top-priority vulnerability. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes the worst realistic case: network-reachable, low-complexity, no privileges, no user interaction, with a scope change and total confidentiality/integrity/availability impact. CWE-863 (Incorrect Authorization) combined with 'arbitrary code execution in the context of the current user' means an authorization check can be bypassed to reach a code-execution path. All signals that would raise or lower urgency beyond CVSS are ABSENT: no EPSS score, no CISA KEV listing, and no public POC are present in the provided data - so exploitation status is 'no public exploit identified at time of analysis'. Note the input Tags include 'Authentication Bypass', which is loose: the CWE is Incorrect Authorization (authz), not authentication bypass - the flaw more likely bypasses an access-control decision than a login. The single self-reported Adobe advisory (APSB26-142) is the only reference, so severity rests entirely on vendor scoring with no independent corroboration or exploit evidence. Bottom line: treat as critical and patch on an emergency cadence because of the unauth-RCE profile, but recognize real-world exploitation is currently unproven rather than confirmed. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to an internet-reachable Adobe Campaign Classic instance that reaches a function guarded by a faulty authorization check, bypasses that check, and executes arbitrary code as the current application user. Because no user interaction and no credentials are required (PR:N/UI:N) and scope is changed, a single request can pivot from the ACC service into adjacent components. No public proof-of-concept exploit is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that should have been access-controlled, achieving arbitrary code execution in the context of the current application user without any user interaction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) reflects a scope-changing flaw, meaning the vulnerable component can affect resources beyond its own security boundary - a combination that makes this a genuine top-priority vulnerability for any internet- or partner-reachable ACC deployment. As of analysis there is no CISA KEV listing and no public exploit identified at time of analysis; Adobe's advisory APSB26-142 is the authoritative source for affected and fixed builds.
RemediationAI
No vendor-released patch version is enumerated in the provided data, so the first action is to open Adobe's advisory APSB26-142 (https://helpx.adobe.com/security/products/campaign/apsb26-142.html) and identify the exact fixed build for your ACC release line, then upgrade to that build; the reference is the only authoritative source for version numbers and should not be substituted with guessed versions. Until the fix is applied, and because exploitation requires no authentication or user interaction, prioritize reachability reduction: place the ACC instance and its console/API endpoints behind VPN or IP allowlisting so only trusted administrative networks can connect, accepting that this breaks externally sourced campaign delivery, webhooks, and third-party API integrations that previously reached the instance directly. Restrict or disable any unused externally facing ACC endpoint or connector, and add reverse-proxy or WAF rules that drop unauthenticated requests to privileged administrative and workflow paths - noting such rules are signature-dependent and may cause false positives against legitimate automation. Run the ACC application with a least-privilege service account and file-system/DB rights, since executed code runs only in the context of the current application user rather than as root/SYSTEM, limiting lateral movement and damage if compromise occurs. Finally, enable and monitor ACC audit and access logs for anomalous unauthenticated administrative actions, workflow creation, or outbound connections, and treat any such finding as a potential compromise requiring credential rotation and forensic review.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-863 (Incorrect Authorization): an access-control decision is made incorrectly or skipped entirely, so a request that should require elevated privilege is processed as though it were authorized. In Adobe Campaign Classic - a marketing campaign management platform whose web/console endpoints expose campaign orchestration, workflow, and server-side scripting functionality - a broken authorization check on such an endpoint can let a request from an unauthenticated client reach code paths that ultimately execute attacker-controlled logic. The CVSS vector confirms network reachability (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high confidentiality, integrity, and availability impact. The scope-changed flag (S:C) indicates the exploited component can impact resources outside its own security authority, which is consistent with an authorization boundary failure rather than a simple input-handling bug. CPE data lists cpe:2.3:a:adobe:adobe_campaign_classic:*:*:*:*:*:*:*:* - a wildcard version string, meaning the provided intelligence does not enumerate a precise affected version range or the fixed build; that detail must be resolved against APSB26-142. Code execution is limited to the privileges of the current application user rather than root/SYSTEM, which constrains the immediate blast radius but does not reduce the severity given the scope change.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network RCE with no interaction and an authorization-check bypass enabling code execution; scope change and full CIA impact all follow directly from the described unauth ACE.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
Executive ViewAI
Adobe Campaign Classic is affected by a critical, unauthenticated remote code execution vulnerability (CVE-2026-75723, CVSS 10.0) that can allow a network attacker to execute arbitrary code under the application user context without user interaction, and its scope-changing nature means compromise can extend beyond the vulnerable component. Organizations with internet- or partner-reachable ACC deployments are most at risk, potentially exposing marketing operations, customer data, and connected enterprise systems. As of analysis, no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis, so leadership should treat this as an urgent exposure that could lead to full platform compromise, data loss, and regulatory or brand damage.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to trusted IPs/VPN, enforce MFA and least privilege for ACC, disable unused endpoints/integrations, deploy WAF/IPS virtual patching, segment ACC from critical systems, and monitor for exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Exploit-DB