CVE-2026-89275

CriticalCVSS 10.0/10Last modified Sep 23, 2026

Description

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
Adobe	Adobe Campaign Classic	<= 7.4.4 build 9401

References

https://helpx.adobe.com/security/products/campaign/apsb26-142.htmlVendor Advisory

Timeline

Published: Sep 22, 2026
Last modified: Sep 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-892769.9Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in CVE-2026-892775.5CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service CVE-2026-892785.3The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensiti CVE-2026-892796.5Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects au CVE-2026-892804.3The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to CVE-2026-892818.4The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf CVE-2026-892829.1The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability thr CVE-2026-892838.6The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password acti CVE-2026-892858.6The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL quer CVE-2026-892865.3The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly acce CVE-2026-892878.6The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowi CVE-2026-892888.6The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated RE