CVE-2026-48323: Adobe Campaign Classic RCE Vulnerability

CVE-2026-48323 Overview

Adobe Campaign Classic (ACC) contains a template engine injection vulnerability that allows unauthenticated attackers to execute arbitrary code remotely. The flaw stems from improper neutralization of special elements passed to the template engine [CWE-1336], enabling attackers to break out of template context and execute code in the context of the current user. Exploitation requires no user interaction and no privileges, and the scope changes upon successful exploitation, meaning impact extends beyond the vulnerable component. Adobe published the fix in security bulletin APSB26-120 on August 3, 2026.

Critical Impact
Unauthenticated remote attackers can execute arbitrary code against exposed Adobe Campaign Classic instances, with full compromise of confidentiality, integrity, and availability across the trust boundary.

Affected Products

Adobe Campaign Classic version 7.4.3 build 9394
Adobe Campaign Classic version 7.4.3 builds 9396, 9397, and 9398
Adobe Campaign Classic deployments on Linux and Microsoft Windows hosts

Discovery Timeline

2026-08-03 - CVE-2026-48323 published to the National Vulnerability Database
2026-08-03 - Adobe releases security bulletin APSB26-120 with patched builds
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-48323

Vulnerability Analysis

Adobe Campaign Classic uses a server-side template engine to render personalization content, delivery messages, and workflow expressions. The vulnerability arises when user-controllable input reaches the template engine without proper neutralization of engine-specific syntax. An attacker who supplies crafted template directives can break out of the intended data context and reach the underlying script interpreter.

This condition maps to CWE-1336, Improper Neutralization of Special Elements Used in a Template Engine. Because ACC template engines commonly expose scripting primitives such as JavaScript execution and object access, template escape typically results in direct code execution on the application server. The advisory confirms exploitation occurs in the context of the current user process running the Campaign services.

A changed scope indicates the vulnerable component crosses a security boundary during exploitation. In practice, a successful attack against the Campaign application can impact downstream databases, connected marketing systems, and file system resources reachable by the Campaign service account.

Root Cause

The root cause is missing or insufficient sanitization of special template syntax before evaluation. Values that should be treated as inert data are instead parsed as template directives. This design flaw allows attacker-supplied strings to be interpreted as executable code paths inside the engine.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request containing template metacharacters to an exposed Adobe Campaign Classic endpoint. The server-side template engine evaluates the injected directives and executes attacker-controlled code under the Campaign service account.

Adobe's advisory does not publish exploit code, and no public proof-of-concept has been observed. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. See the Adobe Security Bulletin APSB26-120 for vendor technical guidance.

Detection Methods for CVE-2026-48323

Indicators of Compromise

Unexpected child processes spawned by Adobe Campaign services such as nlserver, including shells, cmd.exe, powershell.exe, bash, or scripting interpreters
HTTP POST or GET requests to Campaign endpoints containing template metacharacters such as <%, %>, ${, or JavaScript object references in unexpected parameters
Outbound network connections from Campaign application hosts to unfamiliar external IP addresses shortly after suspicious inbound requests
New or modified files under Campaign installation directories or web-accessible paths that were not deployed by administrators

Detection Strategies

Alert on any process creation where the parent is an ACC service binary and the child is an interpreter or shell
Inspect Campaign web server access logs for template syntax in query strings, form fields, and JSON bodies targeting personalization or delivery endpoints
Correlate high-volume or malformed requests to Campaign endpoints with subsequent process, file, or network anomalies on the same host

Monitoring Recommendations

Enable verbose logging on Campaign application servers and forward logs to a centralized analytics platform for retention and correlation
Baseline normal Campaign process trees and network destinations so that deviations trigger investigation
Monitor authentication and privilege use for the Campaign service account, particularly file writes to system paths and outbound connections

How to Mitigate CVE-2026-48323

Immediate Actions Required

Apply the updates listed in Adobe security bulletin APSB26-120 to all Adobe Campaign Classic 7.4.3 builds 9394, 9396, 9397, and 9398
Restrict network exposure of Campaign Classic administrative and delivery interfaces to trusted management networks only
Rotate credentials, API keys, and service account secrets accessible to the Campaign application after patching
Review Campaign application, web server, and host logs for evidence of exploitation predating the patch

Patch Information

Adobe released fixed builds for Adobe Campaign Classic 7.4.3 as documented in Adobe Security Bulletin APSB26-120. Administrators should upgrade to the vendor-specified patched build corresponding to their current deployment. Verify installed versions with nlserver config or the ACC console after upgrade to confirm remediation.

Workarounds

If patching cannot be completed immediately, place a web application firewall in front of Campaign endpoints and block requests containing template metacharacters such as <%, %>, and ${ in user-controllable parameters
Terminate or firewall public access to Campaign delivery, tracking, and administrative endpoints until the patch is applied
Reduce the privileges of the Campaign service account so that successful code execution has minimal reachable resources

bash

# Example WAF rule concept (ModSecurity syntax) to block template metacharacters
# in requests to Adobe Campaign endpoints until patching completes
SecRule REQUEST_URI "@beginsWith /nl/" \
    "id:1004823,phase:2,deny,status:403,log,\
    msg:'ACC template metacharacter blocked (CVE-2026-48323)',\
    chain"
    SecRule ARGS|REQUEST_BODY "@rx (<%|%>|\$\{)" \
        "t:none,t:urlDecodeUni"