Adobe Campaign Classic CVE-2026-89276

Requires an authenticated low-privileged account on the target Adobe Campaign Classic instance (PR:L) - this is the primary limiting factor; it is NOT remotely exploitable by fully unauthenticated attackers, unlike sibling CVE-2026-73369/75699/75721. No user interaction is needed (UI:N) and no special non-default configuration is named in the advisory. The advisory does not identify the specific vulnerable feature, endpoint, or code-evaluation path, so the exact ACC component that must be reachable is unconfirmed. Realistic exposure is highest where low-privilege ACC accounts are broadly provisioned or where the console/web tier is network-reachable to semi-trusted users.

CVSS 9.9 (Critical) is driven by the network vector (AV:N), low attack complexity (AC:L), only low privileges required (PR:L), no user interaction (UI:N), and a changed scope (S:C) yielding C:H/I:H/A:L. The core signal is CWE-94 code injection producing arbitrary code execution in the context of the current user. However, this is Adobe-self-reported with a SINGLE advisory reference (APSB26-142) and NO corroborating exploitation signals: EPSS is not provided, the CVE is NOT in CISA KEV, and no POC is identified. So the numeric severity is high but the real-world exploitation evidence is thin - no public exploit identified at time of analysis. Note one internal tension: RCE normally implies A:H, yet Adobe rated availability only A:L, implying the code-execution context is meaningfully constrained (limited privileges of the current user rather than full system compromise); this is consistent with the S:C claim (impact reaches beyond the vulnerable component's authorization scope) but the modest availability rating slightly tempers the 'total takeover' reading. This CVE is one of a large APSB26-142 batch of ACC flaws and is the authenticated (PR:L) counterpart to the CWE-94 unauthenticated 10.0 items (CVE-2026-73369/75699/75721) - those are the higher-priority members of the family because they need no credentials. Bottom line: a genuine priority for organizations running ACC, but exploitation likelihood signals (EPSS/KEV/POC) are all absent, so treat as patch-soon rather than confirmed active-threat. Fix build/version is not stated in the advisory text provided - verify against the live Adobe advisory before scheduling remediation.

A low-privileged authenticated user of an Adobe Campaign Classic instance submits crafted input to a vulnerable code-generation/evaluation path, injecting attacker-controlled code that the server executes in the current user's context. Because scope is changed and no user interaction is needed, the attacker can pivot beyond the originally authorized component. No public proof-of-concept is available at time of analysis.