Adobe Campaign Classic contains an unauthenticated code injection flaw rated CVSS 10.0 that could allow remote arbitrary code execution with no user interaction required.
What Is It
CVE-2026-75721 is an Improper Control of Generation of Code vulnerability (CWE-94) in Adobe Campaign Classic (ACC). Per Adobe's advisory, the flaw "could result in arbitrary code execution in the context of the current user." Based on the CVSS vector Adobe assigned, exploitation would not require user interaction. Scope is changed, meaning the impact extends beyond the vulnerable component's own security boundary.
The CVE was published by Adobe's PSIRT on 2026-09-22 and currently sits in NVD as "Awaiting Analysis."
Why It Matters
This is a maximum-severity finding. Adobe assigns it a CVSS 3.1 base score of 10.0 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Every exploitability factor is worst-case:
- Network attack vector: reachable remotely
- Low attack complexity: no special conditions needed
- No privileges required: unauthenticated
- No user interaction: fully automatable
- Changed scope: impact crosses a security boundary
Confidentiality, integrity, and availability impacts are all rated High. The exploitability subscore is 3.9 (the maximum) and the impact subscore is 6.0. A pre-auth RCE of this severity in a marketing platform that typically holds large volumes of customer data is about as bad as a rating gets.
Note: this CVE does not currently appear in CISA's Known Exploited Vulnerabilities catalog, so there is no confirmed active exploitation in the supplied data. That is not a reason to slow-roll remediation given the score.
What's Vulnerable
Adobe lists the affected product as Adobe Campaign Classic, with a default status of unaffected and the following version range flagged:
| Status | Version |
|---|---|
| Affected | 0 through 7.4.4 build 9401 (inclusive) |
| Unaffected | 7.4.4 build 9402 |
No affected CPE entries were published alongside the record, so inventory matching should be done against the build number directly.
Patch Status
A fix is available. Build 7.4.4 build 9402 is listed as unaffected; upgrade any ACC instance at or below build 9401. Adobe's advisory APSB26-142 is the authoritative source for upgrade instructions. No required-action deadline is specified in the supplied data.
Sources
- Adobe Security Bulletin APSB26-142; https://helpx.adobe.com/security/products/campaign/apsb26-142.html
- NVD, CVE-2026-75721, https://nvd.nist.gov/vuln/detail/CVE-2026-75721