EUVD-2026-56841
GHSA-37v8-x43w-g53h
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable SQLi with vendor-stated environment-dependent exploitation gives AV:N/AC:H; PR:N retained per Adobe though 'current user' context suggests possible auth, and SQLi-to-RCE across the DB boundary justifies S:C with full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
AnalysisAI
SQL injection in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 allows a remote attacker to inject crafted SQL and achieve arbitrary code execution in the context of the current user, per Adobe advisory APSB26-123. The flaw is rated CVSS 9.0 (critical) with a scope change, but Adobe notes exploitation depends on conditions beyond the attacker's control (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Adobe Campaign Classic is an on-premise/hosted enterprise cross-channel marketing and campaign management platform that relies heavily on a backend SQL database and a custom query/expression layer. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reaches a SQL statement without proper sanitization or parameterization. In ACC, SQL injection is particularly dangerous because the application's SOAP/query APIs and expression engine sit close to the database, so injected SQL can be leveraged beyond data theft into command/code execution - consistent with the reported 'arbitrary code execution' and the scope change (S:C) indicating impact crosses the vulnerable component's security boundary into the underlying database/host context.
RemediationAI
Vendor-released patch: ACC v7 7.4.4 build 9400 - upgrade all Adobe Campaign Classic v7 instances at or below 7.4.3 build 9399 to this build as the primary and definitive fix, following the Adobe advisory at https://helpx.adobe.com/security/products/campaign/apsb26-123.html. Until patching is complete, reduce exposure by restricting network access to the ACC application and its SOAP/query API endpoints to trusted management networks or VPN only (trade-off: may disrupt remote operators and integrations), placing a WAF in front of ACC to detect and block SQL injection patterns against campaign/query parameters (trade-off: signature-based rules can be bypassed and may cause false positives on legitimate marketing queries), and enforcing least-privilege on the ACC database account so a successful injection cannot trivially escalate to host-level command execution (trade-off: some ACC features may require elevated DB rights and should be tested). Review database and application logs for anomalous or malformed SQL activity.
OS command injection in Adobe Campaign Classic (ACC) versions up to and including 7.4.4 build 9401 allows attackers to e
Arbitrary code execution in Adobe Campaign Classic (ACC v7 through 7.4.3 build 9399) stems from an incorrect authorizati
Arbitrary code execution in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 lets a remote, unauthenticated atta
Remote code execution in Adobe Campaign Classic (ACC) version 7.4.3 build 9394 and earlier allows unauthenticated networ
Server-side request forgery in Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier escalates to arbitrary
Arbitrary code execution in Adobe Campaign Classic (ACC) versions 7.4.3 build 9397 and earlier stems from an incorrect a
Adobe Campaign versions Build 8770 and earlier have an input validation bypass that could be exploited to read, write, o
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Rated critical
Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability. Rated critical severity (CVSS 9
Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary fi
IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating
Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arb
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today