EUVD-2026-84658
GHSA-7pwv-46gj-3cp4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed ACC instance
-
DeliverySend crafted code-injection request
-
ExploitTrigger server-side code generation flaw
-
ExecutionExecute arbitrary code as current user
-
ImpactPivot across changed scope boundary
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions per the CVSS vector - remote, unauthenticated, no-user-interaction code execution against an internet-reachable Adobe Campaign Classic instance (AV:N/AC:L/PR:N/UI:N). The scope change (S:C) means impact can extend beyond the vulnerable component. Practical limiting factors: the affected version range and fixed build are not stated in the advisory, so defenders must map their deployed ACC build against APSB26-142; exploitation realistically also requires the ACC application interface to be network-reachable rather than isolated behind internal-only access controls. |
| Impact | This is a top-priority vulnerability by every available structural signal, though corroboration is thin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes the worst case: network-reachable, low complexity, no authentication, no user interaction, scope changed, and full confidentiality/integrity/availability impact - unauthenticated remote code execution. CWE-94 (code injection) is consistent with that ACE claim. However, the exploitation-likelihood signals are entirely absent: no EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so real-world exploitation is 'no public exploit identified at time of analysis' rather than confirmed active exploitation. The base severity and the exploitability probability are therefore in tension - a perfect 10.0 CVSS with no evidence of in-the-wild use, which is typical of a freshly vendor-disclosed, self-reported flaw that has not yet been reverse-engineered. Treat it as a high-priority patch (a 10.0 unauth RCE in an internet-facing marketing platform is precisely what attackers weaponize once details surface) while noting the exploitation evidence is currently vendor-theoretical, not observed. Note also this is a near-identical twin of CVE-2026-73369 in the same APSB26-142 advisory (also unauth CWE-94 RCE, CVSS 10.0). |
| Exploit ScenarioDerived | An attacker reaches an internet-exposed Adobe Campaign Classic instance and sends a crafted request that injects code into a server-side generation/evaluation path, achieving arbitrary code execution in the context of the current user without authenticating or requiring any operator interaction. Because scope is changed, the executing code can affect resources beyond the vulnerable component. No public proof-of-concept exploit is available at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to execute arbitrary code with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); no user interaction is required, and the scope change means impact is not necessarily confined to the vulnerable component. The affected version range and fixed build are not enumerated in the available intelligence, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, so risk is currently driven by structural severity rather than observed attacks. Because ACC is an internet-reachable marketing automation platform that typically stores customer data and holds credentials for downstream systems, this should be treated as a top-priority patch item even though corroborating sources are limited to Adobe's own advisory.
RemediationAI
Adobe has published this issue under security bulletin APSB26-142 (https://helpx.adobe.com/security/products/campaign/apsb26-142.html), and that advisory is the authoritative source for the fixed build and upgrade path; the exact patch version is not included in the provided intelligence, so administrators should open the bulletin, identify their deployed ACC build, and apply the vendor-provided upgrade or hotfix rather than assuming the current release is unaffected. Until the upgrade is scheduled, the highest-value compensating control is to remove the ACC application interface from untrusted networks: block external reachability of the web and API endpoints at the firewall or reverse proxy and require internal network or VPN access, accepting the trade-off that remote and third-party integrations will break or need re-routing. Where full isolation is impractical, put the endpoints behind a WAF or access gateway restricted to known client IP ranges, which reduces but does not eliminate exploitation paths for the underlying code-injection sink. Additional hardening includes disabling or restricting any unused workflow scripting, custom web applications, and SOAP/REST endpoints that expose code-evaluation functionality, with the trade-off that legitimate automation and campaign execution may be degraded. Because the flaw requires no credentials or user interaction, log monitoring and alerting should focus on anomalous process execution and unexpected command or script invocation originating from the ACC server; network-layer controls remain effective only while the service is not directly internet-exposed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-94, Improper Control of Generation of Code ('Code Injection'), meaning attacker-supplied input reaches a code-generation or dynamic-evaluation sink rather than being treated as inert data. In an application platform such as Adobe Campaign Classic, that class of flaw typically manifests where server-side scripting, workflow orchestration logic, expression/template evaluation, or exposed web and API endpoints build executable statements from user-controllable values, allowing the injected content to run in the server's process context. The CVSS vector confirms the prerequisites are minimal: network reachability (AV:N), low attack complexity (AC:L), no privileges required (PR:N) and no user interaction (UI:N), so authentication requirements are explicitly unauthenticated per the assessed vector, and the S:C rating indicates the resulting code execution can affect resources beyond the vulnerable component's own security authority. The affected-product CPE, cpe:2.3:a:adobe:adobe_campaign_classic:*:*:*:*:*:*:*:*, uses a wildcard version field, which is consistent with a version range or unspecific build applicability that Adobe's advisory APSB26-142 must be consulted to resolve; the fixed build is not stated in the supplied data, so defenders cannot map an exact version boundary from this report alone.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network code injection (PR:N/AV:N/AC:L/UI:N) yielding arbitrary code execution with scope change justifies S:C and full C:H/I:H/A:H, matching the vendor 10.0.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
Executive ViewAI
Adobe Campaign Classic, the marketing automation platform that typically holds customer records and privileged credentials to downstream systems, carries a maximum-severity (10.0) unauthenticated remote code execution flaw. No vendor patch is available yet and no public exploit has been identified at time of analysis, so the risk today is structural rather than observed - but any internet-reachable instance is a standing open door to full compromise of the platform and potentially the systems it connects to. Leadership should treat this as a top-priority exposure requiring immediate containment of network access while Adobe remediation is pending.
No vendor-released patch identified at time of analysis. Interim mitigations: remove ACC instances from direct internet exposure and place them behind authenticated access gateways or restricted IP allowlists; segment ACC hosts from corporate and production networks to limit scope change; deploy WAF/reverse-proxy filtering and signature-based detection for exploit attempts; enforce monitoring and alerting on unexpected processes, child shells, and outbound connections from ACC servers; rotate or down-scope credentials ACC holds for downstream systems; restrict administrative console access to named, MFA-protected accounts. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Exploit-DB