Adobe Campaign Classic EUVD-2026-52518

The attacker requires network reachability to the Adobe Campaign Classic application (AV:N) and, per the CVSS vector, no authentication (PR:N) and no user interaction (UI:N), with low attack complexity (AC:L) - implying exploitation against a reachable ACC instance without special configuration. However, this conflicts with the 'privilege escalation' classification, which typically presumes a starting account or session; the description does not name a specific feature, protocol, or configuration toggle as a precondition, so the concrete prerequisite (unauthenticated request vs. low-privileged authenticated account) cannot be confirmed from the provided data and must be verified against Adobe APSB26-120. Limiting factors: exploitation is bounded by whether the ACC instance is network-exposed (internal-only deployments behind VPN materially reduce reach), and by the true authentication requirement, which remains unconfirmed.

The signals are partly conflicting and should be treated with caution. CVSS is 9.8 Critical with PR:N (unauthenticated) and AV:N/AC:L, which would indicate trivially exploitable network-based takeover; however, the vulnerability class is privilege escalation, which normally presumes some pre-existing foothold or account - so the PR:N rating and the 'privilege escalation' framing are in tension and should be verified against Adobe advisory APSB26-120. No EPSS score, KEV status, or POC was provided in the input, so probabilistic and in-the-wild exploitation signals are simply absent rather than negative. Given a Critical CVSS from the vendor on a widely-deployed enterprise marketing platform, this warrants prompt patching, but the raw 9.8 may overstate real-world ease-of-exploit until the exact preconditions (authenticated vs. unauthenticated) are confirmed. Absent EPSS and KEV data, prioritize based on exposure of ACC instances to untrusted networks.

An attacker who can reach the ACC application over the network sends a crafted request that the platform incorrectly authorizes, causing it to grant privileges beyond the attacker's intended role and yielding administrative control over campaigns and the underlying customer data. Because the CVSS vector specifies UI:N and AC:L, no victim interaction or elaborate conditions are needed once the endpoint is reachable. No public proof-of-concept was identified at time of analysis, so this scenario is inferred from the CVSS vector and CWE rather than a demonstrated exploit.