EUVD-2026-84657
GHSA-v2h3-4c3w-4q5m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-facing ACC endpoint
-
DeliverySend crafted code-injection payload
-
ExploitApplication generates/executes injected code
-
ExecutionAchieve RCE as current user
-
ImpactPivot across changed scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions confirmed - the vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated, low-complexity exploitation with no user interaction against Adobe Campaign Classic, and the sparse advisory names no required feature toggle or non-default configuration. The primary limiting factor is network reachability: the ACC instance (or the affected endpoint) must be exposed to the attacker, and code executes only in the context of the current application user rather than as an elevated system account. Affected version boundaries are not specified (wildcard CPE), so applicability to a given deployment must be checked against APSB26-142. |
| Impact | This is a genuine top-tier priority, not a paper-CRITICAL. The CVSS 10.0 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes an unauthenticated, network-reachable, low-complexity code-injection RCE with a scope change - the maximum-severity profile, and the only unauthenticated flaw in the APSB26-142 batch (siblings CVE-2026-75728/82010/82443/82008 all require authentication). All impact metrics are High and no user interaction is needed, so raw exploitability is high. However, exploitation-status signals are weak-to-absent: no EPSS score, no CISA KEV listing, and no public POC were provided, so this is 'no public exploit identified at time of analysis' - high potential severity but no evidence of active or automated exploitation yet. SSVC-style reasoning: technical impact is Total, automatable is plausible (unauth network vector) but unconfirmed, exploitation state is 'none' per available data. Note the advisory is Adobe self-reported with a single reference and no independently verified fix build, so affected-version boundaries and patched build should be confirmed directly against APSB26-142 before relying on a remediation claim. No CVSS-vs-description conflict exists; description and vector both point to unauthenticated remote RCE. |
| Exploit ScenarioDerived | A remote unauthenticated attacker sends a crafted request to an internet-reachable Adobe Campaign Classic instance, injecting attacker-controlled code that the application generates and executes, yielding arbitrary code execution in the context of the current application user. Because the flaw requires no authentication and no user interaction (PR:N/UI:N) and the scope is changed, a single request can pivot beyond the vulnerable component. No public exploit code has been identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems running Adobe Campaign Classic, tracked as CVE-2026-73369, per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C with a base score of 10.0 (CWE-94 code injection). Exploitation requires no authentication, no user interaction, and no confirmed special configuration; the vector's changed scope (S:C) means the compromise can affect resources beyond the vulnerable component's security authority, though the code itself runs as the current application user rather than as a privileged system account. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue, but the impact, the low attack complexity, and the two practical limiting factors - network reachability of the ACC instance and the currently unspecified affected version range (CPE is a wildcard) - make this a genuine top-tier priority for any deployment confirmed affected by Adobe advisory APSB26-142.
RemediationAI
Patch availability and the exact fixed build are not specified in the provided intelligence, so the first action is to retrieve Adobe advisory APSB26-142 at https://helpx.adobe.com/security/products/campaign/apsb26-142.html and apply the vendor-designated fixed release for the exact ACC build in use; do not treat the absence of a version string here as evidence that no patch exists. Until that upgrade is verified in place, the decisive control is network exposure, because AV:N/PR:N is what makes exploitation possible without credentials: place the ACC instance and its console, API, and any scripting or template-evaluation endpoints behind a VPN or reverse proxy that permits only trusted source addresses, and terminate or filter external access to non-essential ports - the trade-off is reduced remote accessibility for marketing users and third-party integrations, which may break campaign uploads and API-driven workflows. Restrict administrative and web-console access to named operations staff, and run the ACC service under a least-privilege OS account, since exploitation executes in the context of the current application user and a constrained principal limits blast radius across the changed scope. Harden or disable unused web-facing modules and dynamic script/template evaluation features that are not required in production (accepting that some workflow functionality may stop working), and enable verbose application and workflow logging with alerting so anomalous code-execution attempts surface quickly. If exfiltration or unauthorized code execution is suspected, treat the instance as compromised and rotate ACC credentials, integration secrets, and any database or marketing-platform tokens, because the changed-scope rating means data and connected systems beyond the vulnerable component may have been reachable.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-94, Improper Control of Generation of Code, meaning the application builds or evaluates code from input that an attacker can influence without adequate neutralization, so the injected payload is executed as code rather than treated as inert data. Adobe Campaign Classic is an enterprise marketing automation platform whose deployment includes web-facing console/API components, a workflow engine, and server-side scripting and template evaluation surfaces - exactly the kind of dynamic-evaluation sinks where CWE-94 manifests. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the attacker path is network-based with low complexity and needs neither credentials (PR:N) nor a victim action (UI:N), and S:C indicates the successful exploit crosses a security scope boundary, so downstream components or data outside the vulnerable component's own authority are at risk even though the executing principal is the current application user. The CPE entry cpe:2.3:a:adobe:adobe_campaign_classic:*:*:*:*:*:*:*:* is a wildcard with no version boundary, so the provided intelligence does not identify which ACC builds are vulnerable; version applicability must be resolved against APSB26-142 rather than assumed.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable code injection with no user interaction (PR:N/UI:N/AV:N/AC:L), scope-changed per advisory, and full RCE yielding total C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
Executive ViewAI
Adobe Campaign Classic deployments face a maximum-severity code injection flaw (CVE-2026-73369, CVSS 10.0) that an unauthenticated remote attacker could use to run arbitrary code as the application's own user, with the potential for impact beyond the vulnerable component (scope changed). Because Campaign Classic typically holds customer and marketing data and drives outbound communications, a successful compromise could expose regulated personal information, corrupt campaign integrity, and damage customer trust, and no vendor patch is yet available to close the gap. Any internet- or partner-reachable Campaign Classic instance should be treated by leadership as a top-tier priority for exposure reduction until Adobe ships a fix.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or restrict network reachability of Adobe Campaign Classic instances (VPN, IP allowlisting, reverse proxy, network segmentation); apply WAF/IPS filtering for code-injection patterns against ACC endpoints; run the application and related services under least-privilege accounts without interactive logon or excessive filesystem permissions; disable or firewall unused services, interfaces, and administrative consoles; enable enhanced logging and alerting on ACC hosts for anomalous process execution and outbound connections; and monitor Adobe's advisory for the affected version range and a vendor patch, applying it as soon as it is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Exploit-DB