Adobe Campaign Classic is affected by a critical OS command injection flaw that allows an attacker to run arbitrary code in the context of the current user. This weakness results from insufficient neutralization of special characters used in operating system commands, enabling attackers to inject and execute commands on the server. When exploited, the vulnerability can compromise confidentiality, integrity, and availability by allowing execution of arbitrary code, potentially leading to full system takeover.

The vulnerability affects Adobe Campaign Classic. No specific product versions are listed in the CNA data, so all deployments of Adobe Campaign Classic are potentially impacted unless patched. The impact scope is system-wide because arbitrary code can be executed by the process that hosts the application.

The severity is quantified with a CVSS score of 9.9, indicating a pandemic level of danger. The EPSS score is not available, but the description states that a low-privileged attacker can exploit the issue without user interaction, implying ready to use exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote attacker sending malicious input to the Campaign application, which is then executed in the operating system context of the running user. The scope change indicates that code executing with higher privileges than the original application context is possible.