A critical incorrect authorization vulnerability (CVSS 9.9) in Adobe Campaign Classic lets a low-privileged attacker run arbitrary code over the network without user interaction.
What Is It
CVE-2026-105780 is an Incorrect Authorization vulnerability (CWE-863) in Adobe Campaign Classic (ACC). Adobe's PSIRT reported it, and NVD published the record on 2026-10-27. According to the description, a low-privileged attacker could exploit the flaw to execute arbitrary code in the context of the current user. Exploitation does not require user interaction, and the scope is changed. That means a successful attack can affect resources beyond the vulnerable component's own security boundary.
The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which works out to a base score of 9.9 (CRITICAL). The exploitability subscore is 3.1 and the impact subscore is 6.0.
Why It Matters
The CVSS metrics describe a flaw that is easy to reach and serious if exploited:
- Network attack vector, low complexity: an attacker can reach the flaw remotely, and no special conditions are needed.
- Low privileges required: an attacker needs only a low-privileged account, not an administrator account.
- No user interaction: no victim has to click or open anything.
- Changed scope with high impact: confidentiality, integrity and availability are each rated High, and the impact can extend beyond the vulnerable component.
At the time of writing, this CVE has no CISA Known Exploited Vulnerabilities (KEV) entry, so KEV does not confirm active exploitation. The NVD record has status "Received," so NVD has not yet completed its own analysis.
What's Vulnerable
The NVD record lists the following:
- Vendor: Adobe
- Product: Adobe Campaign Classic
- Affected: all versions up to and including 7.4.4 build 9402
- Unaffected: 7.4.4 build 9403
The record lists no CPE entries yet.
Patch Status
The affected-version data lists Adobe Campaign Classic 7.4.4 build 9403 as unaffected, which suggests that build contains the fix. Adobe covers this issue in security bulletin APSB26-162. Organizations running ACC 7.4.4 build 9402 or earlier should check the Adobe bulletin for exact remediation guidance and upgrade to a fixed build. Because the issue is critical and needs only low privileges, upgrading should be a priority. No CISA KEV required action or due date exists, because the CVE is not listed in KEV.
Sources
- Adobe Security Bulletin APSB26-162; Adobe Campaign
- NVD, CVE-2026-105780
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)