CVE-2026-71398: Adobe Campaign Classic RCE Vulnerability

CVE-2026-71398 Overview

CVE-2026-71398 is an Incorrect Authorization vulnerability [CWE-863] affecting Adobe Campaign Classic (ACC). The flaw allows a remote, unauthenticated attacker to execute arbitrary code in the context of the current user. Exploitation does not require user interaction, and the vulnerability results in a scope change, allowing impact beyond the vulnerable component.

Adobe published security advisory APSB26-123 addressing this issue. The vulnerability received the maximum CVSS 3.1 base score, indicating network-reachable exploitation with no privileges required and full compromise of confidentiality, integrity, and availability.

Critical Impact
Unauthenticated remote attackers can execute arbitrary code on affected Adobe Campaign Classic deployments without user interaction, potentially compromising downstream systems due to the scope change.

Affected Products

Adobe Campaign Classic (ACC)
Refer to Adobe Security Advisory APSB26-123 for affected version ranges

Discovery Timeline

2026-08-11 - CVE-2026-71398 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-71398

Vulnerability Analysis

The vulnerability stems from an authorization defect classified under [CWE-863] Incorrect Authorization. Adobe Campaign Classic fails to correctly verify that a requester holds the permissions required to invoke a privileged operation. An attacker who reaches the affected endpoint over the network can bypass authorization checks and trigger code execution paths intended for privileged callers.

Because the scope is changed, code executed through the vulnerable component can affect resources managed by other security authorities. This magnifies impact beyond the ACC process itself and can extend to connected data stores, integration accounts, and marketing automation workflows.

The EPSS probability of 0.639% reflects a moderate near-term exploitation likelihood relative to the broader CVE population, but the trivial attack complexity and lack of authentication requirements warrant urgent remediation.

Root Cause

The root cause is an authorization check that either fails to execute or reaches an incorrect decision for a sensitive operation exposed by Adobe Campaign Classic. Under CWE-863, the application performs an authorization step but applies flawed logic, permitting actions that should be blocked. Adobe has not publicly disclosed the specific component or code path.

Attack Vector

The attack vector is network-based. An attacker sends a crafted request to a reachable ACC service endpoint. The server processes the request as authorized and executes attacker-controlled logic in the context of the current user. No credentials, user interaction, or prior access are required. Refer to the Adobe Security Advisory APSB26-123 for technical details as they are released.

Detection Methods for CVE-2026-71398

Indicators of Compromise

Unexpected child processes spawned by Adobe Campaign Classic service accounts or the ACC application host
Anomalous outbound network connections from ACC servers to unknown or non-corporate destinations
New or modified scheduled tasks, cron jobs, or workflows on ACC servers that were not deployed by administrators
Access log entries showing requests to ACC endpoints from external or unexpected source addresses immediately preceding process anomalies

Detection Strategies

Monitor ACC application and web server logs for HTTP requests to administrative or privileged endpoints originating from unauthenticated sessions
Alert on process lineage where the ACC service account launches interpreters such as cmd.exe, powershell.exe, /bin/sh, or bash
Correlate authorization failures followed by successful privileged operations from the same source within short time windows

Monitoring Recommendations

Enable verbose audit logging on ACC servers and forward logs to a centralized SIEM for retention and correlation
Baseline normal ACC outbound traffic and file system activity, then alert on deviations
Review integration and service account activity for use outside expected campaign delivery windows

How to Mitigate CVE-2026-71398

Immediate Actions Required

Apply the Adobe security update referenced in Adobe Security Advisory APSB26-123 as the primary remediation
Restrict network exposure of ACC management and API endpoints to trusted administrative networks only
Rotate credentials, API keys, and integration secrets used by ACC if compromise is suspected
Review ACC audit logs for signs of exploitation attempts prior to patching

Patch Information

Adobe has published fixes under advisory APSB26-123. Administrators should identify their deployed ACC build against the advisory's fixed version table and schedule an immediate upgrade. See Adobe Security Advisory APSB26-123 for the authoritative version matrix and download locations.

Workarounds

Place ACC application servers behind a reverse proxy or web application firewall that enforces authentication before requests reach the application
Apply network segmentation to isolate ACC from the public internet and untrusted internal segments
Disable or restrict any non-essential ACC modules and integrations until the patch is applied

bash

# Example: restrict inbound access to ACC management interface using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP