Adobe Campaign Classic CVE-2026-82011

Requires an authenticated low-privileged Adobe Campaign Classic account (PR:L) with network reach to the ACC application; no user interaction is needed and attack complexity is low. Exploitation targets a SQL-injectable input path that lets the attacker inject SQL into a backend query, crossing into the database security context (Scope changed) to achieve unauthorized reads and limited writes. Limiting factors: the attacker must first possess valid credentials (no unauthenticated path per the vector), and impact is bounded to full read exposure but only 'limited write' - not arbitrary integrity/availability compromise. Real-world exposure is highest for ACC instances reachable from untrusted networks where low-privilege accounts are broadly provisioned.

This is a genuine priority for organizations running Adobe Campaign Classic, though its real-world urgency is tempered by an authentication prerequisite. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L, base 9.1) reflects a network-reachable, low-complexity SQL injection requiring only low-privilege authentication and no user interaction, with a scope change (S:C) elevating the score because the injected SQL crosses the security boundary of the application into the database. The high score is driven predominantly by C:H (broad database read exposure) combined with the scope change; integrity and availability are rated only Low (I:L/A:L), consistent with the description's 'unauthorized read and limited write access' rather than full compromise. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so despite the near-critical CVSS this should be read as no public exploit identified at time of analysis - not confirmed active exploitation. The gating factor is that an attacker must already hold a valid low-privileged ACC account, which meaningfully narrows the threat population to insiders or attackers who have first obtained credentials. SSVC-style framing: exploitation is not observed, the flaw is likely automatable once authenticated, and technical impact is partial (limited write) rather than total. Net: patch on a normal-to-elevated cadence, prioritizing internet-exposed instances, but this is not a drop-everything unauthenticated RCE.

An attacker with a low-privileged Adobe Campaign Classic account (or one who has phished/purchased such credentials) submits crafted input to a vulnerable parameter that is concatenated into a SQL query, injecting their own SQL to read data and perform limited writes they are not authorized for, bypassing application security controls. Because Scope is changed and no user interaction is needed, a single authenticated request can reach data across the security boundary. No public proof-of-concept exploit is identified in the available data.