EUVD-2026-52517
GHSA-9x85-p89q-9ghm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Network-reachable eval injection needing only a low-privileged account (PR:L, AC:L, UI:N); arbitrary code execution justifies A:H (vendor rated A:N, likely conservative), and cross-component impact gives S:C.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
AnalysisAI
Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives into dynamically evaluated code (CWE-95 eval injection) and run arbitrary code in the context of the current user. Because the CVSS scope is changed, the impact can reach components beyond the initially exploited one, driving the 9.6 critical score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged authenticated ACC account (CVSS PR:L) with network reachability to the Adobe Campaign Classic application/API - it is NOT anonymously exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals lean toward genuine high priority but with a meaningful gating factor. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged ACC account crafts a personalization expression, workflow parameter, or API input containing injected script directives; when ACC dynamically evaluates that input server-side, the attacker's code executes in the context of the current user. Because scope is changed, the attacker can leverage this to affect resources beyond the initial component, potentially pivoting into campaign data or the hosting environment. … |
| Remediation | Apply the update referenced in Adobe security bulletin APSB26-120 (https://helpx.adobe.com/security/products/campaign/apsb26-120.html) - Patch available per vendor advisory; confirm the exact patched build in that advisory and upgrade the affected ACC instance to it, as no fixed version string is included in this feed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and inventory all ACC deployments, document user access roles, and enable enhanced logging and monitoring for suspicious code execution patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing c
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an a
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a
Same weakness CWE-95 – Eval Injection
View allShare
External POC / Exploit Code
Leaving vuln.today