CVE-2026-48317 is an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability (CWE-95) in Adobe Campaign Classic. This flaw allows a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability changes the scope of execution, enabling potentially harmful code execution. The CVSS v3.1 score is 9.6, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, and high impact on confidentiality and integrity. No patch or official remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could lead to arbitrary code execution with the privileges of the current user, potentially compromising confidentiality and integrity of the affected system. Since the attacker requires only low privileges and no user interaction, the vulnerability poses a significant risk. Availability impact is not indicated. The scope change suggests that the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor Adobe's security advisories for updates. No vendor-provided mitigation or temporary fix is currently documented.