CVE-2026-71398

Adobe Campaign Classic contains an incorrect authorization flaw (CWE-863) that allows an unauthenticated remote attacker to execute arbitrary code in the context of the current user. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates the flaw is reachable over the network with no privileges and no user interaction, and the changed scope shows the executed code crosses a security boundary, meaning a request to a vulnerable Campaign Classic instance can lead to code running beyond the application layer. A successful attacker gains code execution with high impact to confidentiality, integrity, and availability on the affected server. Organizations running Adobe Campaign Classic — typically large enterprises operating on-premises or hybrid marketing infrastructure — are affected; the available data does not specify affected version ranges, so defenders should consult the Adobe security bulletin for exact builds. There is currently no evidence of in-the-wild exploitation, no known public proof-of-concept, and the flaw is not in CISA's KEV; EPSS assigns a 0.8% probability of exploitation within 30 days (54th percentile).

What to do: Patch Campaign Classic to the fixed release identified in the Adobe security bulletin for this CVE, verifying the exact affected and fixed builds there since version ranges were not included in this data. Until patched, restrict network access to Campaign Classic servers from untrusted networks and review application and system logs for unexpected process or command execution. If your instances are hosted or managed by Adobe, confirm with Adobe that hosted environments have already been remediated.