EUVD-2026-65619
GHSA-rjhq-q858-qc66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ACC endpoint
-
DeliverySubmit input with shell metacharacters
-
ExploitBreak out of intended OS command
-
ExecutionExecute commands as service user
-
ImpactPivot into host operating system (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector the vulnerability is remotely reachable (AV:N), low-complexity (AC:L), and requires no user interaction (UI:N) and no privileges (PR:N), implying unauthenticated network exploitation against a reachable Adobe Campaign Classic server. The description does not name the specific vulnerable endpoint, parameter, or configuration, so the exact injectable feature is not confirmed from the provided data. Limiting factors: the ACC server must be network-reachable by the attacker (mitigated when it is restricted to VPN/internal networks), and the unauthenticated (PR:N) claim should be independently verified because ACC command-injection flaws have historically required an operator session - if authentication is in fact required, exploitation is substantially constrained. |
| Impact | Signals are strong but partially unconfirmed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) describes unauthenticated, low-complexity, network-reachable RCE with full CIA impact and scope change - the maximum severity. However, this is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation; EPSS was not provided. That combination (perfect CVSS, no KEV, no POC) is typical of a freshly disclosed vendor-reported flaw where real-world exploitation has not yet materialized - high theoretical priority, but not yet demonstrated in the wild. Caveat: Adobe Campaign Classic command-injection issues have historically required an authenticated/operator context, which would conflict with PR:N; the vendor-supplied PR:N should be verified against the advisory, because if authentication is actually required the practical urgency drops. Treat as urgent-patch but confirm the auth precondition. |
| Exploit ScenarioDerived | An attacker reaches the network-exposed Adobe Campaign Classic endpoint and submits a request whose field carries embedded shell metacharacters that ACC passes into an OS command, causing the injected commands to run in the context of the ACC service account. Because scope is changed, the attacker pivots from the application into the host operating system to install tooling or move laterally. No public exploit is currently identified, so this would require original exploit development against the specific vulnerable feature. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker run arbitrary commands in the context of the running user. The flaw is rated CVSS 10.0 with a network attack vector, no privileges, no user interaction, and a scope change reaching the underlying host. No public exploit identified at time of analysis, but the maximal score and unauthenticated network reach make it a top-tier patching priority.
RemediationAI
Apply the vendor fix per Adobe advisory APSB26-134 as the primary remediation; exact fixed version numbers were not included in the provided data, so obtain them from the public advisory at helpx.adobe.com/security/products/campaign/apsb26-134.html rather than the internal-corp link supplied. Patch available per vendor advisory. Until the update is deployed, reduce exposure by restricting network reachability of the ACC server (place the application and console access behind VPN/allowlists so it is not internet-facing), enforce authentication and least privilege on the account the ACC service runs under to limit the blast radius of code executed in the current user context, and put a WAF/input-filtering layer in front of the exposed endpoint to block shell metacharacters - accepting that WAF rules are a stopgap that can be bypassed and may break legitimate campaign inputs. Because scope is changed to the OS, also monitor the host for anomalous child-process spawning from the ACC service. Do not rely on workarounds as a substitute for the patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Campaign Classic is Adobe's on-premise/hybrid marketing-automation platform for cross-channel campaign orchestration (email, SMS, direct mail) built on a server-side application tier that shells out to the host OS for various tasks. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) means user-influenced input is passed into a system/shell call without adequate sanitization or argument isolation, so shell metacharacters (';', '|', '`', '$()') are interpreted by the OS rather than treated as data. The single wildcard CPE, cpe:2.3:a:adobe:adobe_campaign_classic:*:*:*:*:*:*:*:*, indicates all versions are provisionally in scope pending the vendor's fixed-version list. The scope change (S:C) reflects that code execution moves from the application's trust boundary into the operating-system context.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Mirrors vendor vector: network-reachable, low-complexity OS command injection yielding host-level RCE with full CIA impact and scope change; PR:N retained per vendor but flagged as unverified.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 2
Executive ViewAI
Adobe Campaign Classic contains a critical unauthenticated remote code execution vulnerability (CVE-2026-76195, CVSS 10.0) that allows attackers to execute arbitrary commands on affected systems without requiring access credentials or user interaction. Organizations running ACC face immediate risk of complete system compromise and data theft. The maximal CVSS score, network reach, and absence of a vendor patch make this a top-tier mitigation priority requiring urgent action.
No vendor-released patch identified at time of analysis. Implement these interim mitigations: restrict network access to ACC instances to trusted administrative IP ranges using firewall rules; enforce multi-factor authentication on all ACC administrative accounts; deploy web application firewalls configured to block OS command injection patterns; enable detailed audit logging on ACC process execution and command activity; and maintain offline encrypted backups of ACC data to enable recovery in the event of system compromise. Consider temporarily disabling ACC services if business operations permit until a patch becomes available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Exploit-DB