EUVD-2026-73944
GHSA-pqp6-2hc4-xh8r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
OS command injection yielding host code execution with scope change gives full C/I/A; AV:N/AC:L/UI:N per Adobe, though PR:N is vendor-asserted and unverified for ACC.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 1
AnalysisAI
OS command injection in Adobe Campaign Classic (ACC) versions up to and including 7.4.4 build 9401 allows attackers to execute arbitrary code in the context of the running user with no user interaction. Adobe PSIRT rates this a maximum-severity CVSS 10.0 issue with a changed scope, meaning a successful exploit can affect resources beyond the vulnerable component. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to a vulnerable Adobe Campaign Classic instance (version ≤7.4.4 build 9401) and the ability to send crafted input to the component that passes data into an OS command; per Adobe's CVSS vector it requires no user interaction and no privileges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) describes a worst-case profile: network-reachable, low complexity, no privileges, no interaction, with full confidentiality/integrity/availability impact and a scope change - the basis for the 10.0 rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed release referenced in Adobe security bulletin APSB26-142 (https://helpx.adobe.com/security/products/campaign/apsb26-142.html) - upgrade beyond Campaign Classic 7.4.4 build 9401 to the vendor-designated patched build; the exact patched version should be taken from that advisory rather than inferred. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Adobe Campaign Classic deployments, especially those running 7.4.4 build 9401 or earlier, and immediately restrict network access to authorized internal networks only; enable enhanced logging and alerting for ACC instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in Adobe Campaign Classic (ACC v7 through 7.4.3 build 9399) stems from an incorrect authorizati
Arbitrary code execution in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 lets a remote, unauthenticated atta
Remote code execution in Adobe Campaign Classic (ACC) version 7.4.3 build 9394 and earlier allows unauthenticated networ
Server-side request forgery in Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier escalates to arbitrary
Arbitrary code execution in Adobe Campaign Classic (ACC) versions 7.4.3 build 9397 and earlier stems from an incorrect a
Adobe Campaign versions Build 8770 and earlier have an input validation bypass that could be exploited to read, write, o
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Rated critical
Adobe Campaign versions 16.4 Build 8724 and earlier have a code injection vulnerability. Rated critical severity (CVSS 9
SQL injection in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9399 allows a remote attacker to inject crafted SQL
Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary fi
IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating
Adobe Campaign version 21.2.1 (and earlier) is affected by a Path Traversal vulnerability that could lead to reading arb
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today