{"id":"CVE-2026-104350","kind":"vulnerability","aliases":["CVE-2026-104350"],"related":[],"title":"Adobe Campaign Classic: reflected XSS lets attacker run scripts in victims' sessions","description":"Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.","summary":"Adobe Campaign Classic has a reflected cross-site scripting flaw, so a crafted URL or compromised page can inject script into a user's browser. An attacker could use that script to take over the victim's account or session.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe-campaign-classic","on-premise","vendor","web-ui","xss"],"not_affected_if":["adobe-hosted","user-interaction-required"],"how_to_check":"Unknown for this CVE. Check your build in Client Console Help > About; the latest builds are 7.4.4 build 9403 (Oct 15, 2026) and 7.4.5 build 9420, but no source ties this CVE to them.","fix":null,"status":"open","published_at":"2026-10-27T17:16:55+00:00","first_seen_at":"2026-10-27T17:32:44+00:00","triaged_at":"2026-10-27T17:34:14+00:00","updated_at":"2026-10-27T17:38:37+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-10-27T17:34:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Adobe Campaign Classic: reflected XSS lets attacker run scripts in victims' sessions","impact":"high","summary":"Adobe Campaign Classic has a reflected cross-site scripting flaw, so a crafted URL or compromised page can inject script into a user's browser. An attacker could use that script to take over the victim's account or session.","category":"vendor","nicknames":[],"who_cares":["adobe-campaign-classic","web-ui"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs script in victim's session and takes over the account","analyst_note":"Check the Adobe security bulletin for affected ACC versions, fixed builds and any patch or workaround; NVD text alone gives no versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000514,"input_tokens":3369,"output_tokens":355,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the Adobe security bulletin for affected ACC versions, fixed builds and any patch or workaround; NVD text alone gives no versions.","search":"'-104350':15A,18A '-2026':14A,17A 'acc':75C 'access':104C 'account':69B,111C 'adob':1A,20B,31B,72C 'adobe-campaign-class':19B 'affect':77C 'attack':7A,58B,88C 'browser':56B 'campaign':2A,21B,32B,73C 'chang':140C 'classic':3A,22B,33B,74C 'compromis':47B,135C 'control':106C 'could':59B,89C 'craft':44B,129C 'cross':38B,82C 'cross-sit':37B,81C 'cve':13A,16A 'elev':103C 'exploit':90C,114C 'flaw':41B 'gain':102C 'inject':50B,94C 'interact':120C,132C 'issu':117C 'let':6A 'malici':95C,128C 'must':125C 'on-premis':23B 'page':48B,100C,137C 'potenti':101C 'premis':25B 'reflect':4A,36B,80C 'requir':118C 'run':8A 'scope':138C 'script':9A,40B,51B,62B,84C,96C 'session':12A,71B,113C 'site':39B,83C 'take':64B 'ui':29B 'url':45B,130C 'use':60B 'user':54B,119C 'vendor':26B 'victim':11A,67B,109C,124C 'visit':126C 'vulner':86C,92C 'web':28B,99C,136C 'web-ui':27B 'xss':5A,30B,85C","nicknames":[],"mitigations":[],"who_affected":"Adobe Campaign Classic v7 on-premise and hybrid on-premise components are the likely exposure, since Adobe says hosted instances are remediated for its bulletins; whether this CVE is covered by that is not confirmed. Exploitation needs a user (e.g. a Campaign operator) to open a crafted URL, so teams whose staff log in to the web UI are at most risk. Versions are unconfirmed until Adobe's bulletin for this CVE is found.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104350","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104350","severity":null,"published_at":"2026-10-27T17:16:55+00:00","modified_at":"2026-10-27T17:16:55+00:00","first_seen_at":"2026-10-27T17:32:44+00:00","fetched_at":"2026-10-27T17:32:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-104350:901","url":null,"severity":null,"published_at":"2026-10-27T17:38:37+00:00","modified_at":"2026-10-27T17:38:37+00:00","first_seen_at":"2026-10-27T17:38:37+00:00","fetched_at":"2026-10-27T17:38:37+00:00","note":"NVD says Adobe CNA, CVSS 9.3 (AV:N/UI:R/S:C). CVE is NOT listed in APSB26-142 (18 CVEs, rev. Sep 22) or any bulletin I could find; the newest ACC build 9403 (Oct 15) notes only say 'security improvements', no CVE list. Affected/fixed versions unknown; nothing verified. Settle by finding the Adobe APSB26 bulletin that lists it (likely newer than 142) on adobe.com/trust/security/products/campaign."}],"documents":[{"id":7181,"url":"https://experienceleague.adobe.com/en/docs/campaign-classic/using/release-notes/latest-release","title":"Adobe Campaign Classic v7 release notes (builds 9402, 9403)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}