CVE-2026-48381
CriticalCVSS 9.0Summary
Adobe Campaign Classic (ACC) is affected by an SQL Injection vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code, but exploitation depends on conditions beyond the attacker's control. Exploitation does not require user interaction, and the scope is changed.
Risk Assessment
The risk for the organization includes the possibility of unauthorized code execution in the context of a logged-in user, which could lead to compromise of data confidentiality, integrity, or availability. Due to the changed scope, the attack may affect resources beyond the initially intended ones.
Recommendation
It is recommended to immediately apply patches provided by Adobe for Adobe Campaign Classic. Also, review and restrict user privileges and monitor logs for unusual activities.
Original NVD description (English source)
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.