9.3
CriticalCVSS 3.1 · from adobe
CVE-2026-104350
Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)
Adobe Campaign Classic · Cross-site scripting · CWE-79AffectedAdobe Campaign Classic
FixUpdate to 7.4.4 build 9403 or newer
PublishedOct 27, 17:03 · adobe
ScoredOct 27 · 9.3 · adobe
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data and change data. CVSS impact.
Description
Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
From adobe
Affected and fixed versions
ProductAffectedFixed inAdobe Campaign Classicup to 7.4.4 build 9402–Adobe Campaign ClassicNot affected7.4.4 build 9403
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known