EUVD-2026-50955
GHSA-hq36-26qm-2p5q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network authorization bypass to RCE (AV:N/AC:L/PR:N/UI:N) with full C/I/A impact; S:C follows the description's 'Scope is changed' note, though the supplied vector states S:U.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
AnalysisAI
Arbitrary code execution in Adobe Campaign Classic (ACC) versions 7.4.3 build 9397 and earlier stems from an incorrect authorization flaw (CWE-863) that lets remote attackers run code in the context of the current user without any user interaction. Adobe's PSIRT reported the issue and rates it CVSS 9.8; it is tagged as an authentication-bypass-to-RCE chain. There is no public exploit identified at time of analysis, and it is not on CISA KEV, but SSVC flags the technical impact as total and the attack as automatable.
Technical ContextAI
Adobe Campaign Classic is an on-premises/hosted enterprise marketing-automation and cross-channel campaign platform, typically deployed as a server application handling customer data, email/SMS delivery, and workflow execution. The root cause is CWE-863 (Incorrect Authorization): the application makes an access-control decision but enforces it incorrectly, so a request that should be rejected is instead honored, letting an actor reach functionality that ultimately executes code. The affected CPEs are cpe:2.3:a:adobe:campaign:*:*:*:*:classic:* including the specific 7.4.3 builds 9394, 9396, 9397 and 9398, indicating the flaw sits in the Campaign Classic codebase rather than a bundled third-party library. Because the impacted operations in ACC can invoke server-side logic (workflows/JS activities), an authorization gap of this class commonly translates into code execution rather than mere data disclosure.
RemediationAI
Patch available per vendor advisory Adobe APSB26-114 (https://helpx.adobe.com/security/products/campaign/apsb26-114.html) - apply the fixed build for Campaign Classic 7.4.3 as directed by Adobe (the exact patched build is not unambiguously stated in the available data since CPE lists build 9398 among affected entries while EUVD lists ≤9397 as vulnerable, so confirm the target version directly in APSB26-114 before deploying). Until patched, reduce exposure by restricting network reachability of the ACC application/console and API endpoints to trusted management networks or VPN only, and place the server behind a reverse proxy or WAF that enforces authentication and blocks anonymous access to campaign/workflow execution endpoints; the trade-off is that legitimate remote operators and integrations may need allowlisting. Additionally review and tighten operator/role authorization within ACC and monitor for anomalous workflow or JavaScript-activity execution, accepting the operational overhead of stricter access review.
OS command injection in Adobe Campaign Classic (ACC) versions up to and including 7.4.4 build 9401 allows attackers to e
Arbitrary code execution in Adobe Campaign Classic (ACC v7 through 7.4.3 build 9399) stems from an incorrect authorizati
Arbitrary code execution in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 lets a remote, unauthenticated atta
Remote code execution in Adobe Campaign Classic (ACC) version 7.4.3 build 9394 and earlier allows unauthenticated networ
Server-side request forgery in Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier escalates to arbitrary
Adobe Campaign versions Build 8770 and earlier have an input validation bypass that could be exploited to read, write, o
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Rated critical
Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability. Rated critical severity (CVSS 9
SQL injection in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 allows a remote attacker to inject crafted SQL
Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary fi
IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating
Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arb
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today