This vulnerability is a classic SQL injection flaw that allows an attacker to execute arbitrary code in the context of the current user. The affected application fails to properly neutralize special characters before including them in SQL statements, which is a well‑known weakness cataloged as CWE‑89. The flaw is exploitable by a low‑privileged adversary and does not require any user interaction, meaning it can be triggered remotely without user awareness. The impact extends to changing the scope of the affected system, elevating the attacker’s privileges beyond the original user level.

All installations of Adobe Campaign Classic (ACC) are potentially impacted. No specific version range is provided in the data, implying that any instance of ACC that has not been patched remains vulnerable. The responsibility falls on Adobe Campaign Classic users to confirm that their deployment has received the latest security update.

The CVSS score of 9.9 places this flaw in the critical range, reflecting its ability to allow arbitrary code execution and scope changes. The EPSS score is not available, so an estimation of timely exploitation risk cannot be given. The vulnerability is not listed in the CISA KEV catalog, indicating that there are no known active exploits in the wild at the time of analysis. Nevertheless, the flaw can be leveraged remotely by a low‑privileged attacker with no user interaction, making it a high‑priority risk. Based on the description, the likely attack vector is through network interfaces—such as web forms, REST API endpoints, or other input channels that accept unfiltered user data and forward it to database queries.