CVE-2026-82011 is an SQL Injection vulnerability in Adobe Campaign Classic caused by improper neutralization of special elements used in SQL commands (CWE-89). This flaw enables a low-privileged attacker to bypass security controls and obtain unauthorized read and limited write access to the system. The vulnerability does not require user interaction and affects the security scope, potentially allowing significant unauthorized data access and modification. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, changed scope, high confidentiality impact, limited integrity impact, and low availability impact. No vendor advisory or patch information is currently available.

The vulnerability allows an attacker with low privileges to bypass security features and gain unauthorized read access to sensitive data and limited write capabilities within Adobe Campaign Classic. This can lead to data confidentiality breaches and partial data integrity compromise. The attack can be performed remotely over the network without user interaction, increasing the risk of exploitation. The changed scope indicates that the vulnerability affects resources beyond the initially intended security boundaries.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor Adobe's security advisories for updates. Avoid exposing vulnerable instances to untrusted networks and restrict access to trusted users only.