A critical arbitrary code execution vulnerability in Adobe Campaign Classic, reachable without authentication, presents an extreme risk to infrastructure security.

The application is susceptible to an Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336), allowing an unauthenticated attacker to achieve arbitrary code execution.

With a CVSS score of 10.0, this vulnerability allows for complete system compromise. An attacker successfully exploiting this flaw could gain full control over the host environment, leading to data exfiltration, service disruption, and persistent backdoors within the organization.

Immediate Action: Upgrade to Adobe Campaign Classic version 7.4.3 build 9399 or higher to resolve the template engine vulnerability.

Proactive Monitoring: Monitor server processes for unexpected child process execution or unusual network traffic originating from the application server.

Compensating Controls: Utilize a Web Application Firewall to inspect and sanitize incoming requests for suspicious template-related payloads.

Public Exploit Available: unknown

The maximum severity score of this vulnerability indicates that it is a high-priority threat that should be remediated immediately. Administrators should verify their current build versions and apply the vendor-provided patch without delay.