CVE-2026-75723

Adobe Campaign Classic (ACC) contains an incorrect authorization flaw (CWE-863) that allows a remote, unauthenticated attacker to execute arbitrary code in the context of the current user. The vulnerability is network-exploitable with low attack complexity, requires no privileges and no user interaction, and because the scope is changed, a successful attack can impact resources beyond the vulnerable component with full impact on confidentiality, integrity, and availability, earning it a maximum CVSS 3.1 score of 10.0. This makes an exposed ACC deployment effectively compromisable by anyone who can reach the vulnerable service. Any organization running an affected Adobe Campaign Classic instance (on-premises or hosted) is potentially exposed to server takeover, data theft from campaign/marketing databases, and use of the server as a pivot into the enterprise network. No public proof of concept is known and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, so there is no evidence of in-the-wild exploitation at this time.

What to do: Apply Adobe's security update for Campaign Classic immediately, installing the exact fixed builds listed in the Adobe bulletin, since the flaw is unauthenticated, network-exploitable, and rated CVSS 10.0. Restrict network access so ACC application servers and their web/JSP endpoints are not reachable from the untrusted internet, exposing them only through VPN or IP allow-listing. Review ACC server logs for unexpected or unauthenticated requests and anomalous workflow/script execution that could indicate an exploitation attempt.