CVE-2026-48317 is an Eval Injection vulnerability (CWE-95) in Adobe Campaign Classic that permits arbitrary code execution by improperly neutralizing directives in dynamically evaluated code. The vulnerability can be exploited remotely without user interaction by an attacker with low privileges, resulting in a change of scope and potentially full compromise of the affected system's confidentiality and integrity. The CVSS v3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality and integrity. No official remediation or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with low privileges to execute arbitrary code remotely in the context of the current user, leading to a complete loss of confidentiality and integrity of the affected system. Availability impact is not indicated. The vulnerability does not require user interaction and changes the security scope, increasing the severity of the impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor Adobe's security advisories for updates. No temporary or official fixes have been disclosed at this time.