CVE-2026-71398 — Adobe Campaign Classic Incorrect Authorisation
CVE-2026-71398 is an incorrect authorisation vulnerability in Adobe Campaign Classic, rated CVSS 10.0. It is one of three maximum-severity flaws shipped in Adobe's August 2026 security release, alongside two ColdFusion issues (Cve 2026 48362 Adobe Coldfusion Cmd Injection, Cve 2026 48273 Adobe Coldfusion Eval Injection). Successful exploitation could allow privilege escalation or unauthorised access to campaign data.
Vulnerability Details
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-71398 |
| Type | Incorrect authorisation |
| Product | Adobe Campaign Classic |
| CVSS | 10.0 (Critical) |
| Exploitation status | No in-the-wild exploitation reported at disclosure |
Context
Campaign Classic is widely used for customer-marketing and communications, holding substantial personal data estates — making authorisation flaws material for privacy and data-protection compliance as well as system integrity. Adobe's August release overall addressed multiple critical issues across ColdFusion, Commerce and Campaign Classic; organisations should validate their upgrade paths promptly.
Related Pages
- Cve 2026 48362 Adobe Coldfusion Cmd Injection — ColdFusion OS command injection (CVSS 10.0)
- Cve 2026 48273 Adobe Coldfusion Eval Injection — ColdFusion eval injection (CVSS 9.9)
Sources: raw/digests/Cyber-Digest-2026-08-13