EUVD-2026-56839
GHSA-26p9-67p6-4x27
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ACC application server
-
DeliverySend crafted request bypassing authorization check (CWE-863)
-
ExploitInvoke restricted server-side code path
-
ExecutionExecute arbitrary code as current user
-
ImpactPivot across changed scope to further resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The primary prerequisite is network reachability to the ACC v7 application server (AV:N), running an affected build at or below 7.4.3 build 9399. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are required, so default internet-facing deployments are directly exposed. The main limiting factors are therefore version (instances already on 7.4.4 build 9400 or later are not affected) and network exposure (instances restricted to trusted internal or VPN-only networks are much harder to reach); no special non-default feature toggle is called out in the description as a precondition. |
| Impact | Every available signal points to high real-world risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full CIA impact plus scope change, yielding the maximum 10.0. Adobe's own PSIRT reported it and tags it RCE / Authentication Bypass, which corroborates the severity. Countervailing signals temper urgency somewhat: it is not in CISA KEV (no confirmed active exploitation), no EPSS score was provided in the input, and no public POC is identified, so this is currently a high-severity-but-not-yet-known-exploited issue rather than a confirmed in-the-wild campaign. Given unauthenticated max-severity RCE on an enterprise marketing platform, any operator - from a large enterprise to a small municipal IT team - should treat this as urgent and patch immediately rather than wait for exploitation evidence. If an EPSS score is later published low, that would suggest targeted rather than commodity exploitation, but it would not lower the patching priority for an internet-exposed ACC instance. |
| Exploit ScenarioDerived | An attacker who can reach an internet-exposed Adobe Campaign Classic application server sends a crafted request that abuses the incorrect authorization check to invoke server-side functionality that should be restricted, causing arbitrary code to run in the context of the current user. Because no authentication and no user interaction are required (PR:N/UI:N) and complexity is low, this can be automated against exposed instances; the changed scope means the attacker may pivot beyond the initial component. No public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Arbitrary code execution in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 lets a remote, unauthenticated attacker run code in the context of the current user via an incorrect-authorization flaw (CWE-863). The maximum CVSS 3.1 base score of 10.0 reflects a network-reachable, no-interaction bug with a changed scope, meaning impact can extend beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated RCE and a vendor PSIRT advisory makes this a top-priority patch.
RemediationAI
Vendor-released patch: upgrade ACC v7 to 7.4.4 build 9400, which remediates this vulnerability per Adobe advisory APSB26-123 (https://helpx.adobe.com/security/products/campaign/apsb26-123.html). Because exploitation is remote and unauthenticated, prioritize any internet-facing ACC instances first. Until the upgrade is applied, reduce exposure with compensating controls: restrict network access to the ACC web/application tier so it is reachable only from trusted management networks or via VPN (trade-off: may disrupt remote operators and external integrations/API consumers), place the application behind a WAF or reverse proxy with strict allow-listing of endpoints (trade-off: rules may need tuning and can break legitimate SOAP/API calls), and increase monitoring of ACC application and access logs for anomalous authorization/authenticated-function access (trade-off: detective only, does not prevent exploitation). These are stopgaps only; the exact-version upgrade is the sole confirmed fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Campaign Classic is an on-premise/hosted enterprise marketing-automation and cross-channel campaign platform, typically deployed with internet-facing web/application tiers that process authenticated operator and API traffic. The root cause is CWE-863 (Incorrect Authorization): an authorization check that is present but implemented incorrectly, allowing an actor to reach functionality or resources that should be gated. In ACC this class of flaw is dangerous because the application server can execute server-side logic (e.g., JS/SOAP-style operations and scripted workflows), so an authorization bypass on a code-execution surface escalates directly into arbitrary code execution. No specific CPE strings were supplied beyond the EUVD version ranges, so exact affected build enumeration relies on the Adobe advisory rather than NVD CPE match data.
Know when Campaign gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description states remote code execution with no user interaction and no stated authentication (PR:N), low complexity, and changed scope, warranting AV:N/AC:L/S:C with full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
Executive ViewAI
Adobe Campaign Classic v7 through 7.4.3 (build 9399) contains a critical remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary code with user privileges through an authorization bypass, potentially exposing customer data and marketing campaign infrastructure. This vulnerability is particularly urgent because no patch is currently available from Adobe, leaving all affected organizations in an unpatched vulnerable state. Immediate containment and monitoring measures are required to minimize exposure while awaiting vendor remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: implement strict network segmentation and firewall rules limiting ACC administrative interface access to pre-approved IP ranges only; disable or restrict internet-facing ACC administrative ports; deploy Web Application Firewall rules targeting CWE-863 authorization bypass patterns; enforce least-privilege role-based access controls with regular access reviews; enable comprehensive audit logging for ACC authentication and code execution events; maintain isolated offline backups of ACC data independent from production systems; increase monitoring frequency for indicators of suspicious authentication attempts or unexpected code execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
OS command injection in Adobe Campaign Classic (ACC) versions up to and including 7.4.4 build 9401 allows attackers to e
Arbitrary code execution in Adobe Campaign Classic (ACC v7 through 7.4.3 build 9399) stems from an incorrect authorizati
Remote code execution in Adobe Campaign Classic (ACC) version 7.4.3 build 9394 and earlier allows unauthenticated networ
Server-side request forgery in Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier escalates to arbitrary
Arbitrary code execution in Adobe Campaign Classic (ACC) versions 7.4.3 build 9397 and earlier stems from an incorrect a
Adobe Campaign versions Build 8770 and earlier have an input validation bypass that could be exploited to read, write, o
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Rated critical
Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability. Rated critical severity (CVSS 9
SQL injection in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 allows a remote attacker to inject crafted SQL
Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary fi
IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating
Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arb
Exploit-DB