EUVD-2026-52514
GHSA-mw86-mqfv-c5gr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable bypass with no credentials yields high confidentiality impact; no integrity or availability impact described or inferable from available data.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.
AnalysisAI
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a violation of secure design principles (CWE-657). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that exploitation requires no credentials, no user interaction, and low attack complexity against any network-accessible ACC instance, yielding high confidentiality impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no special conditions are required beyond network reachability: no authentication, no special privileges, no user interaction, and no elevated attack complexity. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N represents a genuinely elevated real-world risk: the attack is network-reachable, requires no authentication or privileges, imposes no complexity barrier, and yields high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker with network access to an Adobe Campaign Classic deployment sends a crafted HTTP request targeting an endpoint whose security control is bypassed due to the CWE-657 design flaw, obtaining read access to sensitive marketing data - potentially including subscriber PII, contact lists, or regulated personal data - without supplying valid credentials. The low attack complexity (AC:L) indicates no special preconditions or sequencing is required beyond network reachability, making this straightforward to exploit once the bypass vector is identified. … |
| Remediation | Apply the update specified in Adobe security advisory APSB26-120 (https://helpx.adobe.com/security/products/campaign/apsb26-120.html); exact patched version numbers are listed there and should be used as the authoritative upgrade target. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Adobe Campaign Classic instances and review advisory APSB26-120 to confirm which versions are affected; immediately restrict network access to ACC systems to authorized users only via firewall rules or network segmentation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing c
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an a
Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives in
Same weakness CWE-657 – Violation of Secure Design Principles
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today