Adobe Campaign Classic EUVD-2026-65618

The concrete prerequisite is network reachability of the Adobe Campaign Classic application component that funnels attacker-influenced input into an OS command; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no user interaction and, per the vendor rating, no authentication is required against affected default deployments, with scope change (S:C) allowing impact beyond the ACC process. Limiting factors: the reachable endpoint must be an affected ACC version, and in practice ACC is frequently deployed behind authentication and network segmentation, so if the vulnerable interface is not exposed pre-authentication in a given environment the unauthenticated (PR:N) assumption may not hold - verify exposure against the vendor advisory before relying on raw CVSS.

Signals point to a genuine top-priority issue rather than a high-CVSS-but-low-real-risk case: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality/integrity/availability loss and a scope change (S:C) - hence the 10.0. That said, several corroborating signals are absent: no EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so real-world exploitation probability cannot be quantified from this data. The PR:N rating is vendor-assigned; because ACC is typically an authenticated enterprise application deployed behind access controls, defenders should verify whether the vulnerable endpoint is truly reachable pre-authentication in their deployment. Net: treat as critical and patch urgently, but the 'unauthenticated' assumption warrants environment-specific validation.

An attacker reaches an ACC application endpoint that passes attacker-controlled input into a server-side OS command and injects shell metacharacters to append their own command, which executes with the privileges of the ACC service/user and, given the scope change, can pivot to affect other components on the host. No user interaction is required, so the attack can be fully automated once the vulnerable endpoint is reachable. No public exploit is identified at time of analysis, so this reflects the vendor-described attack path rather than an observed one.