Adobe Campaign Classic EUVD-2026-84651

Requires an authenticated low-privileged account on the Adobe Campaign Classic application (PR:L), reachable over the network (AV:N), with no user interaction (UI:N) and low attack complexity (AC:L). The concrete prerequisite is credentialed access to an ACC instance whose input reaches an unsanitized SQL query path; anonymous attackers cannot exploit it directly. Limiting factors: the credential requirement narrows exposure to provisioned users, and organizations restricting ACC to internal networks or trusted operator accounts further reduce realistic attack surface. Exact vulnerable versions must be confirmed against APSB26-142.

This is a genuine high-priority vulnerability that should not be dismissed as CVSS-inflation. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is internally coherent with the description: SQL injection (CWE-89) reachable over the network by a low-privileged authenticated user with no user interaction, escalating to arbitrary code execution with a changed scope. The scope change plus full C/I/A impact is what drives the near-maximal score, and the 'arbitrary code execution in the context of the current user' language supports the I:H/A:H rating credibly. Countervailing signals: no EPSS score, no CISA KEV listing, and no public POC were provided, so despite the critical score there is no evidence of active exploitation or automatable mass-exploitation at this time - this is a paper-critical finding rather than a confirmed in-the-wild threat. No SSVC decision fields were provided. The one genuine gate is PR:L: the attacker must already hold valid low-privilege credentials to the ACC application, which meaningfully narrows the exposed population to authenticated users versus fully anonymous internet attackers. Net: treat as urgent-to-patch (especially for internet-exposed ACC instances with many low-trust accounts), but current exploitation likelihood is unquantified due to missing EPSS/KEV/POC data.

A low-privileged authenticated user of an Adobe Campaign Classic instance submits crafted input into a field or API parameter that is concatenated into a backend SQL query, injecting SQL that the database executes. Because the flaw permits arbitrary code execution in the current user's context with a changed scope, the attacker pivots from data-tier injection to command execution beyond the application boundary. No public exploit code was identified at time of analysis, and no user interaction is required.