CVE-2026-104350

Summary

Adobe Campaign Classic contains a reflected XSS vulnerability (CWE-79) where untrusted input from a URL or page interaction is echoed back without proper sanitization, allowing attackers to execute arbitrary scripts in victims' browsers when they click a malicious link.

Exploitability

Exploitation requires social engineering to trick a user into visiting a crafted URL or interacting with a malicious page; no authentication or special privileges are needed.

Blast radius

Successful exploitation could lead to account takeover, session hijacking, or privilege escalation within Adobe Campaign Classic, potentially compromising sensitive marketing data and campaign configurations.

Detection

Defenders should monitor web server access logs for requests containing suspicious script payloads (e.g., <script>, javascript:, onerror=) in query parameters or POST bodies, especially when such requests are followed by browser-initiated navigation to unexpected endpoints. Look for HTTP 200 responses with reflected script fragments in the HTML body.

Prioritized remediation

Upgrade to Adobe Campaign Classic version 2.590 or later, where this XSS issue has been patched.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.