CVE-2026-84412

Adobe Campaign Classic (ACC) is affected by an improper control of code generation flaw (CWE-94) that permits arbitrary code execution in the context of the current user. The vulnerability is network-exploitable, requires no authentication, no privileges, and no user interaction, and carries a maximum CVSS 3.1 base score of 10.0 with a changed scope, meaning a successful exploit can impact resources beyond the vulnerable component. An attacker who exploits this gains full control over confidentiality, integrity, and availability of the affected server — a significant risk given ACC typically stores large customer/marketing databases and sends communications on behalf of the organization. Any organization running an affected build of Adobe Campaign Classic, whether on-premise or Adobe-managed, is potentially exposed. No public proof-of-concept exists, the issue is not on CISA's KEV list, and no in-the-wild exploitation has been reported, but the perfect CVSS score makes it highly attractive to attackers.

What to do: Immediately check Adobe's security bulletin for this CVE and upgrade affected Campaign Classic builds to the patched versions — the unauthenticated, no-interaction nature of this flaw makes patching urgent. Until patched, restrict internet access to ACC application/web endpoints via IP allowlisting or VPN, and closely monitor affected servers for unexpected code execution, unusual processes, or post-exploitation activity. Since affected version ranges were not specified in this data, confirm your build number directly against Adobe's advisory.