Adobe Campaign Classic CVE-2026-75728

The CVSS vector (PR:N/UI:N) indicates unauthenticated remote exploitation with no user interaction against a network-reachable Adobe Campaign Classic instance; the description explicitly confirms 'Exploitation of this issue does not require user interaction.' The primary limiting factors are: the target ACC instance must be network-accessible to the attacker (ACC deployments are frequently internal/segmented rather than internet-facing), and resulting code execution is bounded to the context of the current user rather than a privileged/system account. The advisory does not disclose a specific non-default feature or configuration prerequisite, so exploitation appears to target the standard ACC application surface.

The vendor CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a remotely reachable, unauthenticated, low-complexity flaw requiring no user interaction, which normally warrants top-tier prioritization. However, several risk-amplifying signals that would confirm urgency are absent: EPSS is not provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so this is a high-CVSS issue with no evidence of active or imminent exploitation at time of analysis. A notable internal inconsistency: the description states this results in 'arbitrary code execution in the context of the current user,' yet the vendor vector sets A:N (no availability impact), which is unusual for a code-execution flaw and suggests the impact model may be constrained to the current user's session/data rather than full host compromise - this warrants verification against the Adobe advisory. The CWE-863 (Incorrect Authorization) classification also tempers the 'RCE' framing: the root cause is an authorization gap that permits an operation the user should not be able to invoke, rather than a memory-corruption primitive. Net: treat as a genuine high priority for ACC operators given unauthenticated network reachability, but note that the exploitation-likelihood signals (EPSS/KEV/POC) are all missing rather than confirming widespread risk.

A remote, unauthenticated attacker sends a crafted request to an internet- or intranet-reachable Adobe Campaign Classic instance, abusing an incorrect-authorization check to invoke a privileged operation that leads to code execution in the context of the current user. No user interaction or valid credentials are required. No public exploit code is identified at time of analysis.