CVE-2026-48317

Received Received - Intake

Improper Code Evaluation in Adobe Campaign Classic

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: Adobe Systems Incorporated

Description

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-48317

EUVD

EUVD-2026-52517

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	campaign_classic	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

Executive Summary

Adobe Campaign Classic has an Eval Injection vulnerability where improper neutralization of dynamically evaluated code allows arbitrary code execution. A low-privileged attacker can exploit this without user interaction to run malicious code in the context of the current user.

Impact Analysis

This vulnerability allows attackers to execute arbitrary code on your system with the privileges of the current user. It could lead to data theft, system compromise, or further network infiltration if the user has elevated permissions.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed.

Mitigation Strategies

Apply the latest security patches or updates from Adobe for Campaign Classic to address the improper neutralization of directives in dynamically evaluated code. Ensure proper input validation and restrict user privileges to minimize potential exploitation.

Hi! I’m here to help you understand CVE-2026-48317. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70