Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Critical 9.9
CVE-2026-105780
Adobe Campaign Classic — remote code execution.
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.
WeaknessCWE-863: Incorrect authorization
Published Updated Source NVD
CVSS 3.1
9.9
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Exploit chance, 30 days
0.5%
Higher than 42% of all CVEs (EPSS)
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Adobe Campaign Classic, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
References
Timeline · UTC
- Published to NVD
- NVD record updated
Also actively exploited
Other CVEs in Adobe Campaign Classic
7 more CVEs
9.9Adobe Campaign Classic — remote code execution.EPSS 0.5%9.1Adobe Campaign Classic — SQL injection.EPSS 0.3%10.0Adobe Campaign Classic — remote code execution.EPSS 0.5%9.3Adobe Campaign Classic — cross-site scripting.EPSS 0.6%9.9Adobe Campaign Classic — remote code execution.EPSS 0.6%9.9Adobe Campaign Classic — remote code execution.EPSS 1.3%