EUVD-2026-84661
GHSA-rwv8-wwjh-xwr7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege ACC operator
-
DeliverySend crafted request to vulnerable endpoint
-
ExploitInject arbitrary SQL via unneutralized input
-
ExecutionExecute SQL commands in database context
-
ImpactAchieve arbitrary code execution as current user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Adobe Campaign Classic session with HIGH privileges (PR:H) - the attacker must already hold or compromise a high-privileged operator account before reaching the vulnerable SQL-building code path. Given that gate, exploitation is remote (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N), with a scope change (S:C) allowing impact beyond the vulnerable component into the database/host context. The primary limiting factor is the high-privilege prerequisite; secondary factors are that the instance must be network-reachable to the attacker and running an affected ACC version. No special non-default feature toggle is named in the advisory. |
| Impact | This is a genuine but conditionally-gated issue rather than a drop-everything emergency. The vendor CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is internally consistent and I agree with it: network-reachable, low complexity, no user interaction, scope-changed, and full CIA impact via SQL-injection escalating to arbitrary code execution in the current-user context. The single most important limiting signal is PR:H - exploitation requires an already high-privileged Adobe Campaign Classic account, which sharply narrows the realistic attacker population to insiders or attackers who have already compromised a privileged operator. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so per precision rules this is 'no public exploit identified at time of analysis.' The high base score is driven by impact and scope change, not by ease of access; treat this as a high-value patch on internet-exposed ACC instances but below the priority of the unauthenticated 10.0 siblings in the same APSB26-142 batch (e.g., CVE-2026-73369, CVE-2026-75699, CVE-2026-75721). No signals conflict: CVSS, description, and the absence of exploitation telemetry all point to a serious-but-authenticated-high-privilege flaw. |
| Exploit ScenarioDerived | A high-privileged Adobe Campaign Classic operator (or an attacker who has hijacked such an account) submits crafted input to a function that builds SQL without proper neutralization, injecting arbitrary SQL that executes in the database and escalates to arbitrary code execution in the current-user context. No user interaction is needed and the attack is fully remote over the network. No public proof-of-concept is identified in the available data, so exploitation would require the attacker to develop the technique independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
SQL injection in Adobe Campaign Classic allows an attacker who already holds a high-privileged operator account to execute arbitrary SQL against the platform's database and, per Adobe, achieve arbitrary code execution in the context of the current user, with the scope change indicating impact that reaches beyond the vulnerable component. The flaw is remotely reachable, low-complexity, and requires no user interaction, but it is gated behind the PR:H prerequisite in the assessed vector, meaning the attacker must first hold or compromise a privileged ACC session and be able to reach the instance over the network. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 9.1 base score with a scope change reflects a serious post-compromise escalation path rather than a pre-authentication remote takeover.
RemediationAI
Adobe has published a security bulletin for Campaign at https://helpx.adobe.com/security/products/campaign/apsb26-142.html (APSB26-142); follow it to identify and apply the fixed build for your exact Adobe Campaign Classic release, as an exact patched version number is not confirmed in the available data. Until the upgrade is complete, the highest-value control is reducing the attack surface behind the PR:H gate: audit and aggressively trim the set of high-privileged operator accounts, enforce least privilege and strong authentication on operators, disable or delete dormant and shared administrative accounts, and monitor privileged operator activity and database query logs for anomalous or syntactically unusual SQL. Restrict network reachability so that ACC administrative and operator interfaces are only accessible from trusted management networks or via VPN rather than the public internet, noting the trade-off of reduced flexibility for remote marketers and integrators. Where a WAF or database-layer filtering is available, apply SQL-injection signatures in front of ACC, accepting that signature bypass is possible and this is a compensating control rather than a fix. Restricting or disabling unnecessary high-privilege integrations and scheduled workflows that build dynamic SQL reduces exposure but may interrupt legitimate campaign automation, so changes should be tested in a staging instance first.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command: user-supplied input is concatenated or otherwise inserted into a SQL statement without adequate parameterization or escaping, so attacker-controlled data is interpreted as SQL syntax by the underlying database. In Adobe Campaign Classic, a server-side marketing-automation and campaign-management platform, SQL is assembled throughout the application to query its database for campaign data, targeting rules, delivery parameters and operator-held objects; the vulnerable code path is reachable through the application's normal authenticated interfaces rather than through an unauthenticated endpoint. The assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H confirms network reachability, low attack complexity and no user-interaction requirement, with the PR:H metric showing that only high-privileged operators can trigger the injection. The S:C scope change is significant: it indicates the exploited component's privilege boundary is crossed, so successful injection is not confined to the ACC application context but extends into the database and host layer, which is consistent with Adobe's statement that arbitrary SQL execution can lead to code execution in the context of the current user. The CPE string cpe:2.3:a:adobe:adobe_campaign_classic:*:*:*:*:*:*:*:* is version-agnostic, so the vendor advisory should be used to determine which specific ACC builds and hosted/managed deployments are in scope.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Remote SQLi escalating to code execution needs a high-privilege authenticated account (PR:H), no UI, low complexity; scope change and full CIA impact match arbitrary code execution.
Primary rating from Vendor (adobe).
CVSS VectorNVD
DescriptionNVD
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary SQL commands. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe Campaign Classic is affected by a critical authenticated SQL injection that allows an attacker with a high-privileged operator account to execute arbitrary SQL and escalate to code execution, potentially compromising campaign data, customer information, and platform integrity. The immediate organizational risk is concentrated in teams that grant broad administrator rights or expose ACC interfaces to untrusted networks, because the flaw is gated behind a privileged session rather than anonymous access. No public exploit identified at time of analysis; no vendor-released patch identified at time of analysis, so leadership should prioritize privileged-access reduction and monitoring while awaiting vendor remediation.
No vendor-released patch identified at time of analysis; restrict network access to Adobe Campaign Classic, enforce least privilege and MFA for privileged operator accounts, monitor privileged SQL and login activity, rotate high-privileged credentials, and deploy WAF/database activity monitoring with SQL injection protections.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Exploit-DB