Adobe Campaign Classic EUVD-2026-84654

Requires a low-privileged authenticated account on the target Adobe Campaign Classic instance (PR:L) that can reach the vulnerable input-processing component over the network (AV:N). No user interaction is required (UI:N) and attack complexity is low (AC:L), so once an attacker has any valid low-privilege ACC credential the flaw is directly reachable. The limiting factor is therefore the authentication requirement: this is not exploitable by a fully anonymous remote attacker. The specific vulnerable feature/endpoint and the input that triggers CWE-20 are not named in the sparse APSB26-142 advisory, so precise reachability should be confirmed against Adobe's guidance and the fixed build applied.

This is a genuinely high-priority vulnerability by CVSS math (9.9) but the exploitation signals are thin. The vendor-supplied vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with a scope change and full CIA impact - arbitrary code execution in the current user's context. All three exploitation-likelihood signals are absent: no EPSS score is provided, the CVE is not in CISA KEV, and no POC has surfaced. Exploitation status is therefore 'no public exploit identified at time of analysis.' The internal consistency between the CWE-20 (improper input validation → ACE) description and the CVSS vector is good - the PR:L in the vector matches the 'low-privileged attacker' language in the description, so the authenticated qualifier is supportable. Key caveats: this is a single-source, Adobe-self-reported advisory (APSB26-142) with no independent corroboration, no fixed build number is published in the input, and no affected/fixed version boundaries are given in the CPE (wildcard). Net: treat as a real priority for organizations running ACC because it requires only low-privilege access and yields code execution across a scope boundary, but note that real-world exploitation is not yet demonstrated and the advisory detail is sparse.

An attacker who already holds a low-privileged authenticated foothold in an Adobe Campaign Classic instance (e.g., a limited operator account) submits crafted input to a network-reachable ACC component that fails to validate it, triggering arbitrary code execution in the context of the current user without any interaction from another user. Because scope is changed, the resulting code execution can affect resources beyond the initially vulnerable component. No public exploit code is currently identified.