Description
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Published: 2026-09-22
Score: 10 Critical
EPSS: 1.2% Low
KEV: No
Impact: Arbitrary code execution
Action: Patch Immediately
AI Analysis

Impact

Adobe Campaign Classic suffers from an Improper Control of Generation of Code vulnerability that allows an attacker to inject and execute arbitrary code with the privileges of the current user. The weakness is a code injection flaw (CWE‑94) and does not require user interaction, with the attack changing the scope of the vulnerability.

Affected Systems

The affected product is Adobe Campaign Classic from Adobe. No specific version numbers are listed; any deployments of ACC should verify whether they have applied the available security patch.

Risk and Exploitability

The CVSS score of 10 indicates a critical severity. The EPSS score is 1%, indicating a very low but nonzero probability of exploitation, and the vulnerability is not listed in CISA KEV, but the lack of a KEV status does not reduce the risk. Exploitation can occur remotely with no user interaction, so the potential for widespread impact is high. Immediate patching is strongly recommended.

Generated by OpenCVE AI on September 23, 2026 at 15:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Adobe Campaign Classic security update detailed in Adobe Security Bulletin APSB26‑142.
  • Restart the Campaign Classic services to ensure the patch takes effect.
  • If an immediate patch cannot be applied, restrict external access to the application, disable or limit features that allow code generation, and enforce strict role‑based access controls to mitigate the risk of injection.

Generated by OpenCVE AI on September 23, 2026 at 15:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Adobe campaign
Linux
Linux linux Kernel
Microsoft
Microsoft windows
CPEs cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*
cpe:2.3:a:adobe:campaign:7.4.4:9400:*:*:classic:*:*:*
cpe:2.3:a:adobe:campaign:7.4.4:9401:*:*:classic:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Adobe campaign
Linux
Linux linux Kernel
Microsoft
Microsoft windows

Tue, 22 Sep 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe campaign Classic
Vendors & Products Adobe
Adobe campaign Classic

Tue, 22 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Title Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Adobe Campaign Campaign Classic
Linux Linux Kernel
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-09-26T22:51:23.179Z

Reserved: 2026-08-18T01:29:54.619Z

Link: CVE-2026-75699

cve-icon Vulnrichment

Updated: 2026-09-26T22:49:19.764Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-22T18:17:15.760

Modified: 2026-09-26T23:16:35.460

Link: CVE-2026-75699

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T15:45:06Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')