Adobe Campaign Classic is vulnerable to an Improper Control of Generation of Code flaw that allows an attacker to execute arbitrary code in the context of the current user. The flaw requires only low-level privileges and does not need any user interaction, and exploitation changes the original scope of the vulnerability. The impact is unilateral code execution that can compromise the integrity and confidentiality of the affected system.

The affected product is Adobe Campaign Classic. No specific version range is listed in the advisory, so all installations of Adobe Campaign Classic deployed before any future patches should be considered vulnerable.

The CVSS score of 9.9 places this flaw in the Critical range, and the EPSS score is not available, indicating that the exploit probability is not quantified. It is not yet listed in the CISA Known Exploited Vulnerabilities catalog. The attack vector is not detailed in the input; based on the nature of the flaw and that it does not require user interaction, the likely attack path is a remote exploitation through exposed application interfaces, but this is inferred rather than stated outright.