Adobe Campaign Classic EUVD-2026-84666

No special conditions - remote unauthenticated code execution against default configurations of Adobe Campaign Classic (PR:N, UI:N, AC:L), requiring only network reachability to the ACC server. The description states exploitation does not require user interaction. The primary limiting factor is exposure: risk is greatest for internet-facing or attacker-reachable ACC deployments, whereas instances confined to internal networks behind strong segmentation reduce the practical attack surface. No specific feature toggle, non-default setting, or authentication level is named as a prerequisite in the advisory.

This is a genuine top-priority vulnerability by every structural signal in the input. The vendor CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields the maximum 10.0 base score: network attack vector, low complexity, no privileges, no user interaction, scope change, and full high impact to confidentiality, integrity, and availability. As a CWE-94 code-injection reachable pre-authentication, it is the most severe class of flaw and warrants emergency patching for any internet-exposed ACC instance. That said, the exploitation-likelihood signals are ENTIRELY ABSENT, not low: no EPSS score is provided, the CVE is NOT in CISA KEV, no public POC is referenced, and no SSVC decision data (exploitation/automatable/technical-impact) accompanies the record. Exploitation status is therefore 'no public exploit identified at time of analysis' - the 10.0 reflects potential impact and ease of exploitation, not observed activity. This is a single-source, Adobe-self-reported advisory (APSB26-142) with no independent corroboration, so the severity rests wholly on the vendor's own CVSS. No signals conflict; the picture is simply high-impact-but-unproven-in-the-wild. Notably this is the fourth unauthenticated 10.0 CWE-94 code-injection in the same APSB26-142 batch, mirroring CVE-2026-73369, CVE-2026-75699, and CVE-2026-75721 exactly, which reinforces that Adobe found a cluster of pre-auth code-execution defects and treated them uniformly.

An unauthenticated attacker reaches an internet-facing Adobe Campaign Classic server and sends a crafted request that injects attacker-controlled code into a component that improperly generates/evaluates code, achieving arbitrary code execution in the context of the current user with no interaction from any operator. Because scope is changed, the impact can extend beyond the vulnerable component to other resources on the host. No public exploit code is referenced at time of analysis, so exploitation currently requires the attacker to develop their own working payload.