Adobe Campaign Classic EUVD-2026-84667

No special conditions per the vendor vector - remote unauthenticated exploitation (PR:N/UI:N/AC:L) against Adobe Campaign Classic, requiring only network reachability to the vulnerable ACC instance/component. The advisory does not name a specific feature, protocol, or non-default setting as a prerequisite, so the primary practical limiting factor is network exposure (whether the affected ACC endpoint is internet-facing versus internal-only) and running an unpatched version. Scope is changed, meaning successful exploitation can affect resources beyond the vulnerable component.

The vendor CVSS of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) marks this as maximum severity: network-reachable, low-complexity, unauthenticated, no user interaction, with a scope change and full CIA impact. Exploitation status is 'no public exploit identified at time of analysis' - the sole reference is Adobe's own advisory APSB26-142, with no EPSS score, no CISA KEV listing, and no public POC provided in the input. So the theoretical risk (unauthenticated RCE in the current-user context) is severe and, if the affected component is internet-exposed, warrants priority patching; but the practical exploitation signal is currently absent and the disclosure is single-source (vendor self-reported). No SSVC decision data was supplied. The 10.0 rests entirely on the vendor's own vector; there is no independent NVD analysis, EPSS probability, or corroborating reference to cross-check it against, so treat active-exploitation likelihood as unquantified rather than confirmed. This is a genuine high-priority patch candidate for ACC operators, but its real-world exploitation footprint is unproven at analysis time.

A remote, unauthenticated attacker sends a crafted request to an internet-reachable Adobe Campaign Classic instance that injects attacker-controlled code into a vulnerable generation/processing path (CWE-94), achieving arbitrary code execution in the context of the current user without any user interaction. Because scope is changed, the compromise can extend beyond the vulnerable component to other resources. No public exploit code is identified at time of analysis; assessment relies on the vendor advisory only.