Adobe Campaign Classic EUVD-2026-84653

Requires network access to an Adobe Campaign Classic instance that processes attacker-controlled input through a code-evaluation path (CWE-94). Per the vendor vector (AV:N/AC:L/PR:N/UI:N) exploitation needs no user interaction and no authentication against default configurations, and the scope change (S:C) means impact can extend beyond the initially affected component. Limiting factors: the advisory is sparse and names no specific feature, endpoint, or configuration prerequisite, and the description's 'arbitrary code execution in the context of the current user' wording suggests execution may occur within an existing user/session context - verify with Adobe whether an authenticated session is in fact required, which would contradict PR:N. Exposure is further limited to organizations running the affected ACC versions with the vulnerable component reachable.

The vendor CVSS of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) marks this as maximum-severity: network-reachable, low-complexity, unauthenticated (PR:N), no user interaction, scope-changed, full CIA impact. If those metrics hold, this is a genuine top-priority patch - an unauthenticated remote code-injection (CWE-94) with a scope change into other components. However, several caveats temper the raw score. There is no EPSS score, no CISA KEV listing, and no known public POC, so exploitation status is 'no public exploit identified at time of analysis' - the 10.0 reflects potential impact, not observed activity. The single source is Adobe's own advisory APSB26-142 (the same bulletin that carries sibling CVEs), so the severity is self-reported and not independently corroborated by NVD analysis or third-party research. One internal tension: the description states code executes 'in the context of the current user,' which implies the payload runs with the privileges of an existing/authenticated ACC user session, yet the vector claims PR:N (no privileges) - this pairing should be verified with the vendor, as 'current user' language can indicate a required interactive session rather than purely unauthenticated access. Net: treat as a high-priority patch for exposed ACC instances, but note the 10.0 is a vendor-declared ceiling with no exploitation evidence yet.

An attacker reaches an internet- or intranet-exposed Adobe Campaign Classic instance and submits crafted input that the application interprets as executable code (CWE-94 code injection), triggering arbitrary code execution without any user interaction. Per the CVSS scope change, the injected code can affect resources beyond the initially vulnerable component. No public exploit code has been identified at time of analysis.