The vulnerability in Adobe Campaign Classic is an Incorrect Authorization flaw (CWE-863) that allows an attacker with low privileges to execute arbitrary code in the context of the current user. The exploit does not require user interaction, and the compromise can change the security scope, escalating from a low-privileged account to full code‑execution authority. An attacker could potentially access sensitive data, modify system state, or install malware.

The affected product is Adobe Campaign Classic from Adobe. Specific version information is not provided in the available data, so the scope of the vulnerability across versions cannot be precisely defined. Administrators should check their deployed Adobe Campaign Classic installations for any known security advisories that address this issue.

The CVSS score of 9.9 indicates a high severity, and the lack of an EPSS score makes it unclear how frequently the vulnerability is currently being exploited. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known widespread exploitation yet. Based on the description, the likely attack vector is remote via the web interface, allowing a low‑privileged attacker to trigger the flaw without user interaction. If exploited, the attacker could execute arbitrary code with the privileges of the affected user, potentially impacting confidentiality, integrity, and availability of the system.