CVE-2026-73369: Adobe Campaign Classic RCE Vulnerability

CVE-2026-73369 Overview

Adobe Campaign Classic (ACC) contains a code injection vulnerability [CWE-94] that allows unauthenticated attackers to execute arbitrary code in the context of the current user. The flaw affects the marketing automation platform used by enterprises to orchestrate cross-channel campaigns. Exploitation requires no user interaction and can be triggered over the network. The vulnerability changes scope, meaning successful exploitation impacts resources beyond the vulnerable component itself.

Critical Impact

Unauthenticated remote attackers can execute arbitrary code on Adobe Campaign Classic servers without user interaction, potentially compromising customer data, marketing infrastructure, and connected downstream systems.

Affected Products

• Adobe Campaign Classic version 7.4.4 build 9400
• Adobe Campaign Classic version 7.4.4 build 9401
• Adobe Campaign Classic deployments on Linux and Microsoft Windows

Discovery Timeline

• 2026-09-22 - CVE-2026-73369 published to the National Vulnerability Database
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-73369

Vulnerability Analysis

The vulnerability is classified as Improper Control of Generation of Code [CWE-94]. Adobe Campaign Classic fails to properly sanitize input that is later interpreted or evaluated as code by the application. An unauthenticated attacker can craft a network request containing malicious payload data. The server processes this data through a code generation or evaluation path without adequate validation.

The result is arbitrary code execution in the context of the process running Adobe Campaign Classic. Because the vulnerability has a changed scope, the impact extends past the ACC component itself. Attackers gaining execution on the ACC server can reach connected databases, delivery infrastructure, and integrated marketing systems. The Adobe security advisory APSB26-142 tracks this issue as part of Adobe's coordinated advisory process.

Root Cause

The root cause is insufficient input validation in a code generation or scripting component within Adobe Campaign Classic. ACC exposes server-side scripting capabilities (typically JavaScript execution through the Neolane engine) used to render dynamic campaign content. When user-controllable input reaches these evaluation paths without sanitization, attackers can inject executable code.

Attack Vector

Exploitation occurs remotely over the network. The attacker sends a crafted request to an exposed Adobe Campaign Classic endpoint. No authentication credentials or user interaction are required. Once the malicious input reaches the vulnerable code generation routine, the injected payload executes with the privileges of the ACC service account.

No public proof-of-concept exploit or in-the-wild exploitation has been documented at time of publication. Refer to the Adobe Campaign Security Advisory APSB26-142 for vendor technical details.

Detection Methods for CVE-2026-73369

Indicators of Compromise

• Unexpected child processes spawned by the Adobe Campaign Classic service account, particularly shells (cmd.exe, powershell.exe, /bin/sh, /bin/bash)
• Anomalous outbound network connections from ACC servers to unfamiliar external hosts
• New or modified files in ACC web directories, especially script or executable content
• Unusual entries in ACC application logs referencing scripting APIs or dynamic evaluation functions

Detection Strategies

• Monitor process creation events on ACC servers for interpreters or system utilities launched from the Campaign server process
• Inspect HTTP request logs for anomalous payloads targeting ACC endpoints, particularly requests containing script syntax or encoded code fragments
• Correlate authentication logs with process execution telemetry to identify unauthenticated request sequences preceding suspicious activity

Monitoring Recommendations

• Enable verbose logging on ACC application servers and forward logs to a centralized SIEM for retention and correlation
• Baseline normal outbound network behavior from ACC servers and alert on deviations
• Track file integrity across ACC installation directories, web roots, and configuration files

How to Mitigate CVE-2026-73369

Immediate Actions Required

• Apply the security update referenced in Adobe advisory APSB26-142 to all affected Adobe Campaign Classic installations
• Inventory all ACC deployments and confirm build numbers, prioritizing internet-facing instances for patching
• Restrict network access to ACC administrative and API endpoints using firewall rules or reverse proxy allowlists
• Review ACC server logs and process telemetry retroactively for indicators of prior exploitation

Patch Information

Adobe has published fixed builds through security advisory APSB26-142. Administrators should consult the Adobe Campaign Security Advisory for the exact patched version numbers, download locations, and upgrade procedures applicable to their deployment.

Workarounds

• Place ACC behind a web application firewall configured to inspect and block requests containing suspicious script constructs
• Restrict ACC service account privileges to the minimum required for operation, reducing the blast radius of successful exploitation
• Segment ACC servers from sensitive internal networks and databases where feasible until patches are applied
• Disable or restrict any non-essential ACC scripting or API endpoints exposed to untrusted networks

# Example: restrict access to ACC endpoints at the network layer (iptables)
iptables -A INPUT -p tcp --dport 8080 -s <trusted_admin_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP