Technical impact
Adobe Campaign Classic is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that allows an attacker to execute arbitrary code in the context of the current user. The flaw can be triggered without any user interaction, and exploitation elevates the privilege scope of the user, effectively granting system-wide execution capabilities. This is a severe integrity and confidentiality violation that could lead to full compromise of the affected system.
Affected Systems
All versions of Adobe Campaign Classic are considered vulnerable according to the advisory. The vendor lists the product as "Adobe Campaign Classic," but does not specify affected releases. Administrators should assume that any deployed instance is at risk until a patch is applied.
Risk and Exploitability
The vulnerability carries a CVSS score of 10, reflecting maximum severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is inferred to be remote; an attacker can exploit the template engine from any location with network access to the Campaign Classic service. Successful exploitation results in arbitrary code execution in the context of the attacked user, and the scope is changed, meaning the attacker can impact other components or user accounts. The high score and zero user interaction requirement make this a priority for remediation.
