Adobe Campaign Classic EUVD-2026-111225

Exploitation requires an authenticated low-privileged account on the target Adobe Campaign Classic instance (CVSS PR:L); it is network-reachable (AV:N) and needs no user interaction (UI:N) against affected versions up to and including 7.4.4 build 9402. The specific product feature, endpoint, or configuration that exposes the code-injection sink is not described in the available sources, so the exact trigger is unverified. The principal limiting factor is the authentication requirement - the attacker must first obtain valid low-privilege credentials or an active session; there is no indication that a special non-default configuration is required.

This is a genuine high-priority issue, not an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable, low-complexity code-injection flaw (CWE-94) that needs only low privileges, no user interaction, and crosses a security scope boundary, yielding high confidentiality, integrity, and availability impact (9.9). The vuln.today decision label is act_now, which aligns with the severity and the fact that the advisory originates directly from Adobe. However, several real-world exploitation signals are MISSING from the input and must not be assumed: there is no EPSS exploitation-probability score provided, the CVE is NOT listed in CISA KEV, and no proof-of-concept or exploit reference is present (the only references are the Adobe advisory APSB26-162 and the NVD detail page). So while the intrinsic severity and vendor-driven act_now label argue for prompt patching, there is no evidence of active exploitation or public exploit code at the time of analysis - the urgency here is driven by severity and the act_now decision, not by observed in-the-wild activity. One nuance to verify with the vendor: Adobe describes impact as 'arbitrary code execution in the context of the current user' while the CVSS sets Scope:Changed and all impacts High; the 'current user' phrasing could temper the practical blast radius depending on how ACC runs, so confirm the effective privilege/scope with Adobe.

An attacker who already holds a low-privileged authenticated account on an Adobe Campaign Classic instance sends crafted input to a code-injection sink, causing the server to generate and execute attacker-controlled code with no user interaction. Because the CVSS scope is changed, the resulting execution can affect components beyond the initially vulnerable one. No public proof-of-concept or exploit code is identified in the provided sources.