CVE-2026-82011
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
CRITICAL 9.1
At a glance
- Source
- NVD
- EPSS
- EPSS 0.55 % · percentile 46 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- adobe
- NVD status
- Analyzed
Description
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed.
Weaknesses (CWE)
- CWE-89 — Improper Neutralization of Special Elements used in an SQL Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L | adobe |
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L | NVD · psirt@adobe.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-84656
- GCVE · GCVE-0-2026-82011
Affected configurations (NVD CPE)
cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*≤ 7.4.3cpe:2.3:a:adobe:campaign:7.4.4:9400:*:*:classic:*:*:*cpe:2.3:a:adobe:campaign:7.4.4:9401:*:*:classic:*:*:*
Affected products
| Product | Versions |
|---|---|
| Adobe · Adobe Campaign Classic | affected 0 ≤ 7.4.4 build 9401 ; unaffected 7.4.4 build 9402 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |