Adobe Campaign Classic is affected by an SQL injection flaw (CWE‑89) that permits a low‑privileged attacker to bypass security controls and gain unauthorized read or limited write access. The vulnerability requires no user interaction and is rated with a CVSS score of 9.1, indicating a high‑severity impact. The scope is changed, suggesting the potential for privilege escalation within the application.

The affected product is Adobe Campaign Classic. No specific version information is provided in the advisory, so all deployed instances should be evaluated for the presence of the flaw.

The CVSS score of 9.1 and the lack of a user‑interaction requirement point to a high risk of exploitation. Because the EPSS score is not available and the flaw is not yet listed in CISA KEV, attackers may still discover and exploit the vulnerability over the network or locally, leveraging any user session that can submit input to the application. The changed scope and severity warrant prompt attention.