Summary
generated automatically from NVD dataAdobe Campaign Classic (ACC) contains a reflected cross-site scripting (XSS) flaw, classified as CWE-79, that lets an attacker inject malicious scripts into a web page. Successful exploitation could give the attacker elevated access or control over the victim's account or session, and it requires the victim to visit a crafted URL or interact with a compromised page. The vulnerability has a changed scope and carries a CVSS v3.1 score of 9.3 (CRITICAL).
NVD description
Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
EPSS · FIRST.org
0.60%probability of exploitation in the next 30 days
Higher than 48% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-28, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
This CVE is covered in an article: context, affected versions and published fixes.
CVSS v3.1 Score
Information
- Published
- 27 oct. 2026
- Updated
- 28 oct. 2026
- Status
- Awaiting Analysis
- Source
- psirt@adobe.com
Weaknesses (CWE)
Similar CVEs
Other vulnerabilities of type CWE-79
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.