Adobe Campaign Classic is affected by a reflected cross‑site scripting vulnerability that allows an attacker to embed and execute malicious scripts in the victim’s browser context. If a user visits a crafted URL, the payload runs with the privileges of the authenticated account, enabling the attacker to hijack sessions, capture sensitive data, or potentially elevate privileges. The CVE notes that exploitation changes the vulnerability’s scope, permitting full account‑level compromise.

Adobe Campaign Classic – version information is not specified in the CVE, so all deployments of Adobe Campaign Classic should be considered potentially vulnerable until the fix is applied.

The CVSS base score of 9.3 indicates critical severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV database, but the high score and the requirement of user interaction still warrant rapid remediation. The likely attack vector is a malicious URL that must be opened by a user, making it a social‑engineering style attack that can lead to session hijacking or privilege escalation.