EUVD-2026-84660
GHSA-gf53-9q59-7cq3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ACC endpoint
-
DeliverySend crafted code-injection payload
-
ExploitServer evaluates attacker code
-
ExecutionExecute arbitrary code as current user
-
ImpactPivot across scope boundary
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to an Adobe Campaign Classic instance; per the vendor vector (AV:N/AC:L/PR:N/UI:N) exploitation needs no authentication and no user interaction, and the description explicitly states exploitation does not require user interaction. No special non-default configuration is named in the advisory, so this should be assumed exploitable against default-configured, network-exposed ACC deployments. The primary practical limiting factor is exposure: ACC servers restricted to internal networks or behind strict access controls sharply reduce the realistic attack surface. The exact affected/fixed versions are not stated in the provided data - consult APSB26-142 to scope which builds are vulnerable. |
| Impact | This is a genuine top-priority vulnerability on paper: the vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes unauthenticated, network-reachable, low-complexity arbitrary code execution with a scope change and full C/I/A impact, and CWE-94 (code injection) is consistent with that RCE claim. I concur with the 10.0 score. However, the maturity signals are thin and should temper urgency ranking: there is no EPSS probability provided, no CISA KEV listing, and no public POC - so exploitation status is 'no public exploit identified at time of analysis.' The only source is Adobe's own APSB26-142 advisory (self-reported), with no independent NVD enrichment, no SSVC decision data, and no stated fixed build number. So the risk is: maximal theoretical severity and impact, but no evidence of active or automated exploitation yet. Treat as high-urgency to patch because the barrier to exploitation (no auth, no UI, network) is minimal for a public-facing ACC instance, while acknowledging the actual exploitation likelihood is currently unmeasured rather than confirmed. Note this CVE is one of at least three near-identical unauthenticated 10.0 code-injection issues in the same APSB26-142 batch (with CVE-2026-73369 and CVE-2026-75699), indicating a cluster fix rather than a single isolated bug. |
| Exploit ScenarioDerived | An attacker who can reach an internet-exposed Adobe Campaign Classic server sends a crafted request to a vulnerable endpoint that injects and evaluates attacker-controlled code, achieving arbitrary code execution in the context of the current (application/service) user without any authentication or user interaction. Given AC:L and PR:N, a working exploit would be straightforward to automate once the injection point is known. No public POC or evidence of in-the-wild exploitation exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arbitrary code in the context of the current user, as described by the vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (score 10.0). The flaw is a CWE-94 code injection issue tracked via CPE cpe:2.3:a:adobe:adobe_campaign_classic, with exact vulnerable and fixed builds enumerated only in Adobe advisory APSB26-142, which the provided data points to but does not quote. No public exploit code and no confirmed active exploitation were identified at time of analysis, but because exploitation requires no authentication and no user interaction, any ACC instance reachable from untrusted networks should be treated as high risk.
RemediationAI
The authoritative fix information is Adobe security bulletin APSB26-142 (https://helpx.adobe.com/security/products/campaign/apsb26-142.html); the exact patched build number is not stated in the provided data, so administrators must consult that advisory to identify the vulnerable-to-fixed version transition and apply the vendor hotfix or upgrade for their ACC installation. Until patching is verified, the highest-value compensating control is exposure reduction rather than feature changes: restrict network reachability to the ACC web console, API endpoints, and any exposed workflow/scheduling interfaces to trusted management networks or a VPN, and remove direct internet exposure entirely, since the vendor vector (PR:N/UI:N) means an attacker needs only a reachable endpoint and no credentials. If business requirements force external availability, front the instance with a reverse proxy or WAF that enforces authentication and inspects request bodies for injected code payloads, accepting the trade-off that signature-based filtering is bypassable and may break legitimate API clients. Additionally, log and alert on anomalous requests to ACC administrative and API paths and on unexpected child processes or outbound connections from the ACC server, which is a detective control only and does not prevent exploitation. Scope and urgency should be confirmed against APSB26-142, as Adobe typically rates such bulletins Priority 1 or 2 and may require a full version upgrade rather than a standalone patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Campaign Classic is an enterprise marketing-automation and campaign-management platform that is commonly deployed on-premises or in vendor-hosted configurations and is driven through web consoles, APIs, and workflow/JSSP-style scripting components. The root cause class is CWE-94, Improper Control of Generation of Code ('Code Injection'): attacker-supplied input reaches a code-generation or dynamic-evaluation sink without adequate neutralization, so the input is interpreted as executable logic rather than inert data. The CVSS vector confirms the practical shape of the bug: AV:N and AC:L mean the sink is reachable over the network with low complexity, PR:N and UI:N mean no credentials and no victim interaction are needed, and S:C (scope changed) indicates that code execution can affect security-relevant resources beyond the authority of the originally vulnerable component, while C:H/I:H/A:H reflects total loss of confidentiality, integrity, and availability. The CPE entry carries a wildcard version, so the specific vulnerable build window cannot be derived from the supplied data and must be read from APSB26-142.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description confirms unauthenticated (PR:N), no-interaction (UI:N) network code injection with a stated scope change (S:C) yielding full code execution, so C/I/A all High.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
Executive ViewAI
Adobe Campaign Classic is affected by a critical unauthenticated remote code execution vulnerability (CVE-2026-75721) that allows attackers to execute arbitrary code without credentials or user interaction. This poses a severe risk to organizations using ACC, as exploitation could lead to full system compromise, data breaches, and disruption of marketing operations, potentially impacting customer trust and regulatory compliance. No public exploit identified at time of analysis, but given the maximum CVSS score of 10.0 and no vendor patch, leadership should prioritize immediate risk mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting network access to ACC instances from untrusted networks (e.g., via firewall, VPN, or IP allowlisting); deploying web application firewall (WAF) rules to detect and block code injection patterns; enabling comprehensive logging and monitoring for anomalous code execution or network traffic; applying least privilege principles to ACC service accounts; and isolating ACC from other critical systems through network segmentation. Monitor Adobe advisory APSB26-142 for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Exploit-DB