Adobe Campaign Classic EUVD-2026-111224

Exploitation requires an authenticated attacker holding high (administrative) privileges within Adobe Campaign Classic (PR:H), and affects versions up to and including 7.4.4 build 9402. No user interaction is required (UI:N) and the attack is network-reachable (AV:N) with low complexity (AC:L), but the high-privilege prerequisite is the primary limiting factor - this is not remote unauthenticated exploitation. The specific product feature, input field, or SQL command path that is injectable is not described in the available sources, so the precise trigger cannot be named; defenders should treat any high-privilege ACC account as a path to code execution and prioritize applying the vendor fix in APSB26-162.

This is a genuinely high-severity issue but its practical risk is gated by a significant precondition. The CVSS 3.1 base score is 9.1 (Critical), driven largely by the changed scope (S:C) and full C:H/I:H/A:H impact from SQL injection escalating to arbitrary code execution in the context of the current user. Crucially, the vector requires PR:H - a high-privilege, authenticated attacker - and the vuln.today decision label is act_now, which signals priority remediation despite the privilege barrier. No EPSS score is provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC/exploit reference supplied, so the status is no public exploit identified at time of analysis. No SSVC exploitation/automatable/technical-impact breakdown is provided beyond the act_now label. The signals are internally consistent (network vector, low complexity, no user interaction, but high privileges) rather than conflicting; the main caveat is that PR:H substantially narrows the realistic threat to an attacker who has already obtained high/administrative privileges within Adobe Campaign Classic, making this a privilege-escalation-to-RCE concern for insiders or post-compromise lateral movement rather than a mass-exploitable perimeter bug.

An attacker who already holds high (administrative) privileges in Adobe Campaign Classic submits input containing improperly neutralized special elements into an SQL command path, injecting attacker-controlled SQL. Because scope is changed and impact is full, the injection escalates to arbitrary code execution in the context of the current user without any user interaction. No public exploit or POC reference is present in the supplied data.