Adobe Campaign Classic EUVD-2026-111223

Requires a low-privileged authenticated account on the Adobe Campaign Classic instance (CVSS PR:L); exploitation needs no user interaction and is reachable over the network. The specific injectable feature, parameter, or endpoint is not described in the available sources, so the exact trigger is not described in the available sources - only that unneutralized special elements reach an SQL command. Limiting factors: the attacker must already possess valid low-privilege credentials, and impact is bounded to unauthorized read plus limited write (I:L), not full data manipulation. Affected scope is ACC versions up to and including 7.4.4 build 9402.

Signals align toward genuine priority rather than inflated CVSS. The CVSS 3.1 base score of 9.1 is driven by AV:N (network), AC:L (low complexity), UI:N (no user interaction), and S:C (changed scope), partially offset by PR:L - the attacker must already hold low-privilege access, so this is not a fully unauthenticated flaw. The vuln.today Decision label is act_now, and the issue was reported by Adobe itself via advisory APSB26-162, which raises confidence in the finding's validity. However, no EPSS probability is supplied, the CVE is NOT listed in CISA KEV in the provided data, and no proof-of-concept or exploit reference appears in the input - only vendor/NVD advisory links. So there is currently no evidence of active exploitation or public exploit code despite the act_now label and high score; the urgency derives from severity and vendor attribution, not from observed in-the-wild activity. The main nuance to verify: the high score is largely a product of the scope change (S:C) combined with C:H, yet the description characterizes the outcome as a 'security feature bypass' granting 'unauthorized read and limited write' - confirm with Adobe whether the confidentiality impact truly rates High for your deployment.

A low-privileged user of an Adobe Campaign Classic instance submits crafted input that is not properly neutralized before being used in an SQL command, injecting attacker-controlled SQL to bypass intended security controls. Because no user interaction is required and the attack is over the network, the actor leverages their existing limited account to read data they should not access and perform limited unauthorized writes. No public proof-of-concept or exploit code is identified in the available data.