Adobe Campaign Classic CVE-2026-82003

Requires an authenticated low-privileged account on the Adobe Campaign Classic instance (PR:L) and network reachability to the application (AV:N); no user interaction is needed (UI:N). Exploitation is additionally gated by conditions outside the attacker's control per Adobe (reflected as AC:H) - i.e. specific environmental, timing, or deployment state must hold, so this is not a reliably reproducible remote attack against arbitrary default installs. The vulnerable path is an ACC component that improperly validates attacker-supplied input; the exact feature/endpoint is not named in the advisory summary. Limiting factors: valid credentials required, high attack complexity, and impact confined to code execution in the current user's context (though scope-changed to affect adjacent resources).

CVSS 3.1 base score is 8.5 (HIGH) via CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - network-reachable, but the AC:H flag is significant: Adobe's own text 'Exploit depends on conditions beyond the attacker's control' means reliable exploitation is gated on environmental/timing factors, not merely attacker skill. PR:L confirms an authenticated (low-privileged) attacker is required per the vector. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision record in the input. Signals are internally consistent (self-reported by Adobe, single vendor advisory) rather than conflicting, but they point to a real-but-non-trivial issue: full C/I/A impact and scope change raise theoretical severity, while AC:H plus required authentication materially lower the probability of widespread opportunistic exploitation. This reads as a genuine patch-priority item for ACC operators but not an emergency drop-everything CVE absent evidence of active exploitation. Note the vector's C:H/I:H/A:H is Adobe-supplied and not independently verified by NVD in the provided data.

A low-privileged authenticated user of an Adobe Campaign Classic instance submits crafted input to a component that improperly validates it, triggering arbitrary code execution in the context of the current user. Because scope is changed, the resulting execution can affect resources beyond the initially vulnerable component. No public exploit code is identified, and reliable exploitation depends on environmental conditions outside the attacker's direct control (AC:H).