Adobe Campaign Classic contains an improper neutralization of special elements in an SQL command, a classic SQL injection flaw that can be leveraged by an attacker with high privileges to execute arbitrary code in the context of the current user. The vulnerability is a direct product of failing to properly escape or parameterize user input before including it in database queries. The flaw’s impact is severe, potentially allowing a malicious actor to run any code the compromised account is permitted to execute, thereby compromising confidentiality, integrity, and availability of the system's data and services. Clinical remediation requires an official patch or mitigation that addresses the underlying input handling defect.

The affected product is Adobe Campaign Classic from Adobe. No specific version ranges are disclosed in the advisory, so any deployment of this product should be considered at risk until a vendor‑issued fix is applied. Users deploying older instances lacking the recent security patches should investigate update availability on the Adobe security portal.

The CVSS score of 9.1 indicates critical severity. While the EPSS score is not available, the lack of a listed KEV entry does not diminish the potential for exploitation, especially given that the attack does not require user interaction and the scope is changed. The most likely attack vector is an authenticated attacker with sufficient privileges, but unauthenticated exploitation cannot be ruled out if defensive controls are weak. Continuous monitoring for malicious activity involving unusual database queries is advised until the vulnerability is fully remediated.