CVE-2026-104350: Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)
Received
Published 27-10-2026Last modified 27-10-2026
Vulnerability summary
CVE-2026-104350 is a critical (CVSS 9.3) Cross-site Scripting vulnerability in adobe adobe campaign classic.
CVSS score
9.3/10
010
Critical · v3.1 (CVE.org)EPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Timeline
- 27-10-2026PublishedVulnerability first disclosed.
Description
Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
CVSS metrics
2 scores · 2 sources · 1 versionCritical 9.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NSourcesAll 2 agree
- NVDNIST9.3CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Adobe1 product
- adobe campaign classic≤ 7.4.4 build 9402
1 vendor · 1 product