Adobe Campaign Classic EUVD-2026-84661

Requires an authenticated Adobe Campaign Classic session with HIGH privileges (PR:H) - the attacker must already hold or compromise a high-privileged operator account before reaching the vulnerable SQL-building code path. Given that gate, exploitation is remote (AV:N), low-complexity (AC:L), and needs no user interaction (UI:N), with a scope change (S:C) allowing impact beyond the vulnerable component into the database/host context. The primary limiting factor is the high-privilege prerequisite; secondary factors are that the instance must be network-reachable to the attacker and running an affected ACC version. No special non-default feature toggle is named in the advisory.

This is a genuine but conditionally-gated issue rather than a drop-everything emergency. The vendor CVSS of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is internally consistent and I agree with it: network-reachable, low complexity, no user interaction, scope-changed, and full CIA impact via SQL-injection escalating to arbitrary code execution in the current-user context. The single most important limiting signal is PR:H - exploitation requires an already high-privileged Adobe Campaign Classic account, which sharply narrows the realistic attacker population to insiders or attackers who have already compromised a privileged operator. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so per precision rules this is 'no public exploit identified at time of analysis.' The high base score is driven by impact and scope change, not by ease of access; treat this as a high-value patch on internet-exposed ACC instances but below the priority of the unauthenticated 10.0 siblings in the same APSB26-142 batch (e.g., CVE-2026-73369, CVE-2026-75699, CVE-2026-75721). No signals conflict: CVSS, description, and the absence of exploitation telemetry all point to a serious-but-authenticated-high-privilege flaw.

A high-privileged Adobe Campaign Classic operator (or an attacker who has hijacked such an account) submits crafted input to a function that builds SQL without proper neutralization, injecting arbitrary SQL that executes in the database and escalates to arbitrary code execution in the current-user context. No user interaction is needed and the attack is fully remote over the network. No public proof-of-concept is identified in the available data, so exploitation would require the attacker to develop the technique independently.