Adobe Campaign Classic SQL Injection and Auth Flaws

Arbitrary code execution in Adobe Campaign Classic (ACC) arises from an incorrect authorization flaw (CWE-863) that lets remote unauthenticated attackers run code in the context of the current user without any user interaction. The maximum CVSS 3.1 score of 10.0 reflects a network-reachable, no-privilege attack with a changed scope, meaning impact extends beyond the vulnerable component. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary files from the underlying host by exploiting an SQL injection flaw (CWE-89) that reaches file-system read primitives. Because the CVSS scope is changed and no user interaction is required, a single crafted request against an exposed ACC instance can leak sensitive memory and file contents (CVSS 8.6). There is no public exploit identified at time of analysis, but the network vector and low attack complexity make this a high-priority patch.