Adobe Campaign Classic is vulnerable to an improper control of code generation flaw that permits attacker supplied data to be executed as code in the context of the current user. The flaw is a classic code injection (CWE‑94) and is rated with a 10.0 CVSS score, indicating that exploitation would result in arbitrary code execution. There is no need for user interaction; therefore any compromised token or authenticated session could be used to execute arbitrary commands, potentially exposing sensitive campaign data or disrupting service availability.

The affected product is Adobe Campaign Classic from Adobe. No version information is provided in the advisory, so all installations running the product are considered at risk until a patch is applied.

With a CVSS base score of 10.0 and a scope change, the vulnerability is classed as critical. The EPSS score is not available, and the issue is not yet in the CISA KEV catalog, but the absence of a public EPSS does not mitigate the potential for exploitation in a targeted scenario. Based on the description, an attacker could send specially crafted requests to the Campaign Classic application, likely through custom code or template fields, to cause the application to execute arbitrary code. The attack requires only valid authenticated access, making it feasible to compromise an account and elevate privileges within the system.