9.9
CriticalCVSS 3.1 · from adobe
CVE-2026-104351
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Adobe Campaign Classic · Code injection · CWE-94AffectedAdobe Campaign Classic
FixUpdate to 7.4.4 build 9403 or newer
PublishedOct 27, 17:03 · adobe
ScoredOct 27 · 9.9 · adobe
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
From adobe
Affected and fixed versions
ProductAffectedFixed inAdobe Campaign Classicup to 7.4.4 build 9402–Adobe Campaign ClassicNot affected7.4.4 build 9403
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known