Adobe Campaign Classic
Monthly
Arbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attackers run code in the context of the running ACC service. The vendor's CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) marks it as maximum severity: network-reachable, low-complexity, unauthenticated, requiring no user interaction, with a scope change and full loss of confidentiality, integrity, and availability. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis, so the practical exposure driver is whether an unpatched ACC instance is reachable over the network.
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary code in the context of the affected process, and the CVSS 3.1 base score is the maximum 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with scope changed, meaning a successful compromise can cross the component's security boundary and affect resources beyond its intended authority. No user interaction and no authentication prerequisite are required, so the practical exposure is driven almost entirely by whether an ACC instance is reachable from untrusted networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the structural severity signals make this a top-priority patch item; Adobe's bulletin APSB26-142 is the authoritative source for fixed builds.
Code injection in Adobe Campaign Classic allows an authenticated attacker holding only a low-privileged account to execute arbitrary code on the server in the context of the current user, with no user interaction required (CVSS 9.9, Critical). The flaw is network-reachable and low-complexity, but the required low-privilege account is the primary limiting factor - this is not exploitable by fully unauthenticated remote attackers, unlike some sibling Adobe Campaign issues. No public exploit code and no confirmed active exploitation were identified at time of analysis; Adobe has published a security advisory (APSB26-142) for the issue.
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauthenticated attackers induce the ACC server to issue arbitrary requests to other systems, which the vendor rates as a privilege-escalation risk with a changed scope and a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No authentication or user interaction is required per the vendor vector, so the practical limiting factor is whether the ACC endpoint is reachable by the attacker and whether exploitable internal services sit behind it; Adobe does not document a non-default configuration prerequisite, so default deployments in the affected range appear exposed. Exploitation status at time of analysis is that no public exploit has been identified, and EPSS is a modest 0.69% (51st percentile), though the vendor's high impact rating and the absence of preconditions justify prompt patching. An independent recalibration prefers C:H/I:L/A:N over the vendor's triple-high impact, so the 10.0 figure should be read as Adobe's upper-bound claim rather than a confirmed blast radius.
Server-side request forgery in Adobe Campaign Classic lets an authenticated, low-privileged user force the ACC application server to issue requests to internal or otherwise unreachable resources, turning the account into a foothold for reading confidential internal services (CWE-918; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). Adobe scores the issue 9.9 Critical, while our assessment keeps the scope change and high confidentiality impact but rates integrity as Low - the dominant effect is unauthorized reach into internal resources rather than direct tampering with protected data - which places effective risk in High territory (≈8.5) rather than Critical. Exploitation requires valid low-privileged ACC credentials and network reachability to the application, needs no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis.
Improper input validation in Adobe Campaign Classic allows a low-privileged, authenticated attacker with network reachability to achieve arbitrary code execution in the context of the current user, with the impact scoped beyond the vulnerable component (CVSS 3.1 base 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). No user interaction is required, but Adobe explicitly notes that exploitability depends on conditions beyond the attacker's control, reflected as AC:H - meaning successful exploitation is gated by specific environmental, timing, or deployment state rather than being a reliably reproducible remote attack against default installs. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), and the specific vulnerable feature or endpoint is not named in the advisory summary.
SQL injection in Adobe Campaign Classic allows an attacker who already holds a high-privileged operator account to execute arbitrary SQL against the platform's database and, per Adobe, achieve arbitrary code execution in the context of the current user, with the scope change indicating impact that reaches beyond the vulnerable component. The flaw is remotely reachable, low-complexity, and requires no user interaction, but it is gated behind the PR:H prerequisite in the assessed vector, meaning the attacker must first hold or compromise a privileged ACC session and be able to reach the instance over the network. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 9.1 base score with a scope change reflects a serious post-compromise escalation path rather than a pre-authentication remote takeover.
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arbitrary code in the context of the current user, as described by the vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (score 10.0). The flaw is a CWE-94 code injection issue tracked via CPE cpe:2.3:a:adobe:adobe_campaign_classic, with exact vulnerable and fixed builds enumerated only in Adobe advisory APSB26-142, which the provided data points to but does not quote. No public exploit code and no confirmed active exploitation were identified at time of analysis, but because exploitation requires no authentication and no user interaction, any ACC instance reachable from untrusted networks should be treated as high risk.
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that should have been access-controlled, achieving arbitrary code execution in the context of the current application user without any user interaction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) reflects a scope-changing flaw, meaning the vulnerable component can affect resources beyond its own security boundary - a combination that makes this a genuine top-priority vulnerability for any internet- or partner-reachable ACC deployment. As of analysis there is no CISA KEV listing and no public exploit identified at time of analysis; Adobe's advisory APSB26-142 is the authoritative source for affected and fixed builds.
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to execute arbitrary code with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); no user interaction is required, and the scope change means impact is not necessarily confined to the vulnerable component. The affected version range and fixed build are not enumerated in the available intelligence, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, so risk is currently driven by structural severity rather than observed attacks. Because ACC is an internet-reachable marketing automation platform that typically stores customer data and holds credentials for downstream systems, this should be treated as a top-priority patch item even though corroborating sources are limited to Adobe's own advisory.
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems running Adobe Campaign Classic, tracked as CVE-2026-73369, per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C with a base score of 10.0 (CWE-94 code injection). Exploitation requires no authentication, no user interaction, and no confirmed special configuration; the vector's changed scope (S:C) means the compromise can affect resources beyond the vulnerable component's security authority, though the code itself runs as the current application user rather than as a privileged system account. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue, but the impact, the low attack complexity, and the two practical limiting factors - network reachability of the ACC instance and the currently unspecified affected version range (CPE is a wildcard) - make this a genuine top-tier priority for any deployment confirmed affected by Adobe advisory APSB26-142.
SQL injection in Adobe Campaign Classic lets an authenticated, low-privileged operator inject SQL through an application input path to read the full contents of backend database queries and perform limited writes, with the flaw rated CVSS 9.1 because the injection crosses out of the web tier into the database security context (Scope: Changed). Exploitation requires only a valid low-privilege ACC account, needs no user interaction, and is low complexity; the provided intelligence contains no CISA KEV listing and no public exploit code identified at time of analysis. Real-world urgency therefore hinges on how broadly low-privilege accounts are provisioned and how exposed the ACC application is to untrusted networks.
Server-side request forgery in Adobe Campaign Classic (Classic v7), affecting builds up to and including 7.4.4 build 9401, lets an authenticated low-privileged user coerce the ACC server into making requests to internal systems the user cannot reach directly, with the trust-boundary crossing reflected as a scope change (S:C) that can escalate that user's effective access. No user interaction is required, and Adobe rates the issue 9.9, while our independent assessment retains high confidentiality impact but lowers integrity and availability to Low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and stresses that a valid low-privileged account is a prerequisite, so this is not remote-unauthenticated. No public exploit code and no CISA KEV entry have been identified at time of analysis, EPSS is low at 0.73% (53rd percentile), and SSVC marks the issue non-automatable with total technical impact - making the realistic risk targeted insider or post-foothold abuse rather than opportunistic internet-wide scanning.
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the context of the current user without any victim interaction, because the platform fails to properly validate input reaching an exposed processing component. The flaw scores 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and its scope change means a successful exploit can affect resources beyond the vulnerable component, raising the blast radius for confidentiality, integrity, and availability. The decisive prerequisite is authentication: per the assessed vector (PR:L), any valid low-privilege ACC account that can reach the component over the network is enough, but a fully anonymous remote attacker cannot trigger it; there is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so the exploitation signals remain thin even though the severity math is high.
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current user, carrying a maximum-severity CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with no user interaction required under the vendor vector. The CPE data flags the product with a wildcard version, so the specific affected release range is not enumerated in the supplied intelligence, and Adobe's advisory (APSB26-142) is the only reference. Exploitation status: no public exploit identified at time of analysis; independent analysis cautions that the advisory is sparse and that the description's 'current user' wording may imply an existing session context, so the PR:N unauthenticated rating should be confirmed with Adobe.
Unauthenticated remote code execution in Adobe Campaign Classic allows attackers to execute arbitrary code in the context of the current user due to an incorrect authorization flaw (CWE-863). The flaw is network-reachable with low complexity and no user interaction (CVSS 9.1), though code execution is limited to the application user context rather than system privileges. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in Adobe Campaign Classic allows an authenticated low-privileged user to execute arbitrary code in the context of the current user, with no victim interaction required, carrying a CVSS base score of 9.9. The vulnerability is exploitable over the network with low attack complexity (AV:N/AC:L/PR:L/UI:N) and is rated Scope Changed, meaning a successful attack can escape the ACC application boundary and affect the underlying database or host rather than remaining confined to the web tier. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the credential-only precondition and the low privilege bar make this a priority fix for any broadly provisioned or externally reachable Campaign Classic instance.
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker run arbitrary commands in the context of the running user. The flaw is rated CVSS 10.0 with a network attack vector, no privileges, no user interaction, and a scope change reaching the underlying host. No public exploit identified at time of analysis, but the maximal score and unauthenticated network reach make it a top-tier patching priority.
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands, achieving code execution in the context of the current user with a scope change that extends impact beyond the vulnerable component. Adobe (the reporting vendor) rates this maximum severity CVSS 10.0 (CWE-78), and exploitation requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a vendor-disclosed, not-yet-actively-exploited critical flaw.
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the running user, giving an unauthenticated network attacker full control per Adobe's CVSS:3.1 base score of 10.0 (scope-changed). The flaw lets an attacker coerce the server into making attacker-controlled requests that pivot into code execution with no user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the only reference is an Adobe advisory (APSB26-134) served from an internal, non-public host and could not be independently verified.
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where improperly neutralized special elements in the template engine let an attacker run arbitrary code in the context of the current user. Any exposed ACC instance is affected, and per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, low-complexity, and requires no privileges or user interaction, with a changed scope pushing the CVSS base score to a maximum 10.0. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect score and SSTI class make it a high-priority patch target.
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an attacker gain elevated privileges without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 Critical, implying a network-reachable, low-complexity path to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical based on the vendor advisory.
Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives into dynamically evaluated code (CWE-95 eval injection) and run arbitrary code in the context of the current user. Because the CVSS scope is changed, the impact can reach components beyond the initially exploited one, driving the 9.6 critical score. Reported by Adobe with advisory APSB26-120; no public exploit identified at time of analysis and no CISA KEV listing.
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing crafted internal requests, resulting in privilege escalation without any user interaction. Adobe rates the flaw at the maximum CVSS 10.0 with a changed scope, indicating the SSRF pivots beyond the vulnerable component to compromise other systems or trust boundaries. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a top-priority patch.
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that escalate to arbitrary code execution in the context of the current user, per Adobe advisory APSB26-120. The CVSS 3.1 base score is a maximum 10.0 with a changed scope, reflecting network reachability, no privileges, no user interaction, and full confidentiality/integrity/availability impact spilling into adjacent components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum severity and unauthenticated network vector make this a top-priority patch.
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a violation of secure design principles (CWE-657). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that exploitation requires no credentials, no user interaction, and low attack complexity against any network-accessible ACC instance, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-120 addressing this issue.
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code in the context of the current user without any user interaction. Because unsanitized input reaches an SQL command (CWE-89), an attacker with minimal access can pivot from database manipulation to code execution, and the CVSS scope change (S:C) indicates the impact extends beyond the vulnerable component itself. No public exploit identified at time of analysis, but the 9.9 base score and Adobe's own advisory (APSB26-120) mark this as a top-priority enterprise marketing-platform flaw.
Arbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attackers run code in the context of the running ACC service. The vendor's CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) marks it as maximum severity: network-reachable, low-complexity, unauthenticated, requiring no user interaction, with a scope change and full loss of confidentiality, integrity, and availability. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing) at time of analysis, so the practical exposure driver is whether an unpatched ACC instance is reachable over the network.
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary code in the context of the affected process, and the CVSS 3.1 base score is the maximum 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with scope changed, meaning a successful compromise can cross the component's security boundary and affect resources beyond its intended authority. No user interaction and no authentication prerequisite are required, so the practical exposure is driven almost entirely by whether an ACC instance is reachable from untrusted networks. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the structural severity signals make this a top-priority patch item; Adobe's bulletin APSB26-142 is the authoritative source for fixed builds.
Code injection in Adobe Campaign Classic allows an authenticated attacker holding only a low-privileged account to execute arbitrary code on the server in the context of the current user, with no user interaction required (CVSS 9.9, Critical). The flaw is network-reachable and low-complexity, but the required low-privilege account is the primary limiting factor - this is not exploitable by fully unauthenticated remote attackers, unlike some sibling Adobe Campaign issues. No public exploit code and no confirmed active exploitation were identified at time of analysis; Adobe has published a security advisory (APSB26-142) for the issue.
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauthenticated attackers induce the ACC server to issue arbitrary requests to other systems, which the vendor rates as a privilege-escalation risk with a changed scope and a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No authentication or user interaction is required per the vendor vector, so the practical limiting factor is whether the ACC endpoint is reachable by the attacker and whether exploitable internal services sit behind it; Adobe does not document a non-default configuration prerequisite, so default deployments in the affected range appear exposed. Exploitation status at time of analysis is that no public exploit has been identified, and EPSS is a modest 0.69% (51st percentile), though the vendor's high impact rating and the absence of preconditions justify prompt patching. An independent recalibration prefers C:H/I:L/A:N over the vendor's triple-high impact, so the 10.0 figure should be read as Adobe's upper-bound claim rather than a confirmed blast radius.
Server-side request forgery in Adobe Campaign Classic lets an authenticated, low-privileged user force the ACC application server to issue requests to internal or otherwise unreachable resources, turning the account into a foothold for reading confidential internal services (CWE-918; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). Adobe scores the issue 9.9 Critical, while our assessment keeps the scope change and high confidentiality impact but rates integrity as Low - the dominant effect is unauthorized reach into internal resources rather than direct tampering with protected data - which places effective risk in High territory (≈8.5) rather than Critical. Exploitation requires valid low-privileged ACC credentials and network reachability to the application, needs no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis.
Improper input validation in Adobe Campaign Classic allows a low-privileged, authenticated attacker with network reachability to achieve arbitrary code execution in the context of the current user, with the impact scoped beyond the vulnerable component (CVSS 3.1 base 8.5, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). No user interaction is required, but Adobe explicitly notes that exploitability depends on conditions beyond the attacker's control, reflected as AC:H - meaning successful exploitation is gated by specific environmental, timing, or deployment state rather than being a reliably reproducible remote attack against default installs. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), and the specific vulnerable feature or endpoint is not named in the advisory summary.
SQL injection in Adobe Campaign Classic allows an attacker who already holds a high-privileged operator account to execute arbitrary SQL against the platform's database and, per Adobe, achieve arbitrary code execution in the context of the current user, with the scope change indicating impact that reaches beyond the vulnerable component. The flaw is remotely reachable, low-complexity, and requires no user interaction, but it is gated behind the PR:H prerequisite in the assessed vector, meaning the attacker must first hold or compromise a privileged ACC session and be able to reach the instance over the network. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 9.1 base score with a scope change reflects a serious post-compromise escalation path rather than a pre-authentication remote takeover.
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arbitrary code in the context of the current user, as described by the vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (score 10.0). The flaw is a CWE-94 code injection issue tracked via CPE cpe:2.3:a:adobe:adobe_campaign_classic, with exact vulnerable and fixed builds enumerated only in Adobe advisory APSB26-142, which the provided data points to but does not quote. No public exploit code and no confirmed active exploitation were identified at time of analysis, but because exploitation requires no authentication and no user interaction, any ACC instance reachable from untrusted networks should be treated as high risk.
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that should have been access-controlled, achieving arbitrary code execution in the context of the current application user without any user interaction. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) reflects a scope-changing flaw, meaning the vulnerable component can affect resources beyond its own security boundary - a combination that makes this a genuine top-priority vulnerability for any internet- or partner-reachable ACC deployment. As of analysis there is no CISA KEV listing and no public exploit identified at time of analysis; Adobe's advisory APSB26-142 is the authoritative source for affected and fixed builds.
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to execute arbitrary code with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); no user interaction is required, and the scope change means impact is not necessarily confined to the vulnerable component. The affected version range and fixed build are not enumerated in the available intelligence, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, so risk is currently driven by structural severity rather than observed attacks. Because ACC is an internet-reachable marketing automation platform that typically stores customer data and holds credentials for downstream systems, this should be treated as a top-priority patch item even though corroborating sources are limited to Adobe's own advisory.
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems running Adobe Campaign Classic, tracked as CVE-2026-73369, per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C with a base score of 10.0 (CWE-94 code injection). Exploitation requires no authentication, no user interaction, and no confirmed special configuration; the vector's changed scope (S:C) means the compromise can affect resources beyond the vulnerable component's security authority, though the code itself runs as the current application user rather than as a privileged system account. No public exploit code has been identified at time of analysis and CISA KEV does not list this issue, but the impact, the low attack complexity, and the two practical limiting factors - network reachability of the ACC instance and the currently unspecified affected version range (CPE is a wildcard) - make this a genuine top-tier priority for any deployment confirmed affected by Adobe advisory APSB26-142.
SQL injection in Adobe Campaign Classic lets an authenticated, low-privileged operator inject SQL through an application input path to read the full contents of backend database queries and perform limited writes, with the flaw rated CVSS 9.1 because the injection crosses out of the web tier into the database security context (Scope: Changed). Exploitation requires only a valid low-privilege ACC account, needs no user interaction, and is low complexity; the provided intelligence contains no CISA KEV listing and no public exploit code identified at time of analysis. Real-world urgency therefore hinges on how broadly low-privilege accounts are provisioned and how exposed the ACC application is to untrusted networks.
Server-side request forgery in Adobe Campaign Classic (Classic v7), affecting builds up to and including 7.4.4 build 9401, lets an authenticated low-privileged user coerce the ACC server into making requests to internal systems the user cannot reach directly, with the trust-boundary crossing reflected as a scope change (S:C) that can escalate that user's effective access. No user interaction is required, and Adobe rates the issue 9.9, while our independent assessment retains high confidentiality impact but lowers integrity and availability to Low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and stresses that a valid low-privileged account is a prerequisite, so this is not remote-unauthenticated. No public exploit code and no CISA KEV entry have been identified at time of analysis, EPSS is low at 0.73% (53rd percentile), and SSVC marks the issue non-automatable with total technical impact - making the realistic risk targeted insider or post-foothold abuse rather than opportunistic internet-wide scanning.
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the context of the current user without any victim interaction, because the platform fails to properly validate input reaching an exposed processing component. The flaw scores 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and its scope change means a successful exploit can affect resources beyond the vulnerable component, raising the blast radius for confidentiality, integrity, and availability. The decisive prerequisite is authentication: per the assessed vector (PR:L), any valid low-privilege ACC account that can reach the component over the network is enough, but a fully anonymous remote attacker cannot trigger it; there is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation, so the exploitation signals remain thin even though the severity math is high.
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current user, carrying a maximum-severity CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with no user interaction required under the vendor vector. The CPE data flags the product with a wildcard version, so the specific affected release range is not enumerated in the supplied intelligence, and Adobe's advisory (APSB26-142) is the only reference. Exploitation status: no public exploit identified at time of analysis; independent analysis cautions that the advisory is sparse and that the description's 'current user' wording may imply an existing session context, so the PR:N unauthenticated rating should be confirmed with Adobe.
Unauthenticated remote code execution in Adobe Campaign Classic allows attackers to execute arbitrary code in the context of the current user due to an incorrect authorization flaw (CWE-863). The flaw is network-reachable with low complexity and no user interaction (CVSS 9.1), though code execution is limited to the application user context rather than system privileges. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
SQL injection in Adobe Campaign Classic allows an authenticated low-privileged user to execute arbitrary code in the context of the current user, with no victim interaction required, carrying a CVSS base score of 9.9. The vulnerability is exploitable over the network with low attack complexity (AV:N/AC:L/PR:L/UI:N) and is rated Scope Changed, meaning a successful attack can escape the ACC application boundary and affect the underlying database or host rather than remaining confined to the web tier. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the credential-only precondition and the low privilege bar make this a priority fix for any broadly provisioned or externally reachable Campaign Classic instance.
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker run arbitrary commands in the context of the running user. The flaw is rated CVSS 10.0 with a network attack vector, no privileges, no user interaction, and a scope change reaching the underlying host. No public exploit identified at time of analysis, but the maximal score and unauthenticated network reach make it a top-tier patching priority.
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands, achieving code execution in the context of the current user with a scope change that extends impact beyond the vulnerable component. Adobe (the reporting vendor) rates this maximum severity CVSS 10.0 (CWE-78), and exploitation requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a vendor-disclosed, not-yet-actively-exploited critical flaw.
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the running user, giving an unauthenticated network attacker full control per Adobe's CVSS:3.1 base score of 10.0 (scope-changed). The flaw lets an attacker coerce the server into making attacker-controlled requests that pivot into code execution with no user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the only reference is an Adobe advisory (APSB26-134) served from an internal, non-public host and could not be independently verified.
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where improperly neutralized special elements in the template engine let an attacker run arbitrary code in the context of the current user. Any exposed ACC instance is affected, and per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote, low-complexity, and requires no privileges or user interaction, with a changed scope pushing the CVSS base score to a maximum 10.0. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect score and SSTI class make it a high-priority patch target.
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an attacker gain elevated privileges without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores it 9.8 Critical, implying a network-reachable, low-complexity path to full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation is currently theoretical based on the vendor advisory.
Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives into dynamically evaluated code (CWE-95 eval injection) and run arbitrary code in the context of the current user. Because the CVSS scope is changed, the impact can reach components beyond the initially exploited one, driving the 9.6 critical score. Reported by Adobe with advisory APSB26-120; no public exploit identified at time of analysis and no CISA KEV listing.
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing crafted internal requests, resulting in privilege escalation without any user interaction. Adobe rates the flaw at the maximum CVSS 10.0 with a changed scope, indicating the SSRF pivots beyond the vulnerable component to compromise other systems or trust boundaries. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature makes it a top-priority patch.
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that escalate to arbitrary code execution in the context of the current user, per Adobe advisory APSB26-120. The CVSS 3.1 base score is a maximum 10.0 with a changed scope, reflecting network reachability, no privileges, no user interaction, and full confidentiality/integrity/availability impact spilling into adjacent components. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum severity and unauthenticated network vector make this a top-priority patch.
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a violation of secure design principles (CWE-657). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that exploitation requires no credentials, no user interaction, and low attack complexity against any network-accessible ACC instance, yielding high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-120 addressing this issue.
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code in the context of the current user without any user interaction. Because unsanitized input reaches an SQL command (CWE-89), an attacker with minimal access can pivot from database manipulation to code execution, and the CVSS scope change (S:C) indicates the impact extends beyond the vulnerable component itself. No public exploit identified at time of analysis, but the 9.9 base score and Adobe's own advisory (APSB26-120) mark this as a top-priority enterprise marketing-platform flaw.