Description

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-11T18:18:22.327Z",
  "pubdate": "2026-08-11T18:18:22.327Z",
  "executiveSummary": "Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that permits unauthorized actors to achieve arbitrary code execution within the security context of the currently running user. This security flaw poses a severe risk to enterprise environments utilizing the affected platform, as successful exploitation enables full code execution capabilities on the underlying system. The vulnerability presents a critical threat due to its remote exploitability without requiring any form of user interaction or social engineering. Attackers can independently leverage this flaw to compromise target systems, bypass access controls, and potentially execute malicious payloads. The security scope is explicitly classified as changed, indicating that the impact extends beyond the immediate vulnerable component to affect broader system resources accessible by the process context. Remediation requires strict adherence to vendor-supplied updates and hardening guidelines to eliminate authorization bypass vectors and restrict unauthorized execution paths.",
  "technicalDetails": "The vulnerability resides within the authorization enforcement mechanisms of Adobe Campaign Classic (ACC). Specifically, the application fails to adequately validate and enforce access control decisions before processing requests or executing privileged routines. This flaw in authorization logic allows an unauthenticated or low-privileged attacker to bypass intended security boundaries and invoke sensitive functionalities reserved for authorized entities.\nThe root cause stems from improper implementation of privilege verification checks within the application's request-handling components. When an incoming request is processed, the system fails to correctly map the user's role and permissions to the requested operation, leading to an incorrect authorization state. This enables an attacker to submit crafted inputs or leverage specific application pathways that trigger the insecure execution flow.\nThe attack flow proceeds without requiring user interaction. An attacker transmits a maliciously crafted payload to the exposed network service of the vulnerable Adobe Campaign Classic instance. Because the authorization check is either bypassed or incorrectly evaluated, the application accepts the input and passes it to the underlying execution handler. Within this context, the vulnerable component processes the payload, resulting in arbitrary code execution.\nThe impact of successful exploitation is severe, granting the adversary the ability to execute arbitrary code in the context of the current system user running the Adobe Campaign Classic service. Depending on the privileges assigned to the execution context, post-exploitation behavior may include unauthorized data access, modification or deletion of sensitive databases, lateral movement within the corporate network, and complete system compromise. The network exposure of the service combined with the absence of authentication or complex privilege requirements significantly elevates the exploitability index of this vulnerability."
}