CVE-2026-75699: Adobe Campaign Classic RCE Vulnerability

CVE-2026-75699 Overview

Adobe Campaign Classic (ACC) contains a code injection vulnerability [CWE-94] that allows attackers to execute arbitrary code in the context of the current user. The flaw is network-exploitable, requires no authentication, and does not need user interaction. Adobe published security advisory APSB26-142 addressing the issue. The vulnerability affects Adobe Campaign Classic deployments on both Linux and Microsoft Windows platforms. Because scope changes during exploitation, an attacker who compromises the vulnerable component can affect resources beyond its security authority.

Critical Impact
Unauthenticated attackers can achieve arbitrary code execution across a network with no user interaction, and the scope change enables lateral impact beyond the vulnerable component.

Affected Products

Adobe Campaign Classic version 7.4.4:9400
Adobe Campaign Classic version 7.4.4:9401
Adobe Campaign Classic deployments on Linux and Microsoft Windows

Discovery Timeline

2026-09-22 - CVE-2026-75699 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-75699

Vulnerability Analysis

Adobe Campaign Classic fails to properly control the generation of code from attacker-influenced input. This weakness maps to [CWE-94] (Improper Control of Generation of Code). An unauthenticated remote attacker can send crafted input that the application evaluates or compiles as code, resulting in arbitrary execution under the running user account.

The changed scope indicates the vulnerable component can influence resources outside its own security context. In practice, code executed through the Campaign Classic process can reach adjacent systems, data stores, or services the process interacts with. This turns a single request into a foothold across the marketing automation stack.

Adobe Campaign Classic commonly connects to customer data platforms, mail servers, and enterprise directories. Arbitrary code execution in this context exposes campaign data, subscriber personally identifiable information, and integration credentials.

Root Cause

The root cause is improper control of code generation within Adobe Campaign Classic. Untrusted input reaches an interpreter or code generator without adequate validation or sandboxing. Adobe has not published low-level technical details; refer to the Adobe Product Security Advisory APSB26-142 for vendor-supplied information.

Attack Vector

Exploitation occurs over the network against exposed Adobe Campaign Classic interfaces. The attacker requires no privileges and no user interaction. A single crafted request to a vulnerable endpoint can trigger code evaluation on the server.

// No verified public proof-of-concept is available for CVE-2026-75699.
// Refer to Adobe advisory APSB26-142 for vendor guidance.

Detection Methods for CVE-2026-75699

Indicators of Compromise

Unexpected child processes spawned by the Adobe Campaign Classic service account on Linux or Windows hosts.
Outbound network connections from Campaign Classic servers to unknown external IP addresses or command-and-control infrastructure.
New or modified files in Campaign Classic web-accessible directories, including scripts, executables, or scheduled task definitions.
Anomalous HTTP POST requests to Campaign Classic endpoints containing script fragments, template syntax, or serialized payloads.

Detection Strategies

Monitor process ancestry for the Campaign Classic runtime spawning shells (cmd.exe, powershell.exe, /bin/sh, /bin/bash) or interpreters (python, perl).
Inspect Campaign Classic application logs for evaluation errors, template compilation failures, or unusual API calls that may indicate injection attempts.
Correlate authentication events with subsequent code execution to identify unauthenticated request chains reaching sensitive handlers.

Monitoring Recommendations

Enable verbose logging on Campaign Classic web endpoints and forward logs to a centralized analytics platform for retention and query.
Baseline normal process, network, and file-system behavior of Campaign Classic hosts to surface deviations quickly.
Alert on service-account credential use outside the Campaign Classic host, which may indicate stolen integration credentials.

How to Mitigate CVE-2026-75699

Immediate Actions Required

Apply the patched build listed in Adobe security advisory APSB26-142 to all Adobe Campaign Classic instances.
Inventory Adobe Campaign Classic deployments across Linux and Windows hosts, including versions 7.4.4:9400 and 7.4.4:9401.
Restrict network exposure of Campaign Classic management interfaces to trusted administrative networks only.
Rotate credentials, API keys, and integration secrets used by Campaign Classic after patching, in case of prior compromise.

Patch Information

Adobe released fixed builds for Adobe Campaign Classic under advisory APSB26-142. Administrators should review the advisory to confirm the exact fixed version applicable to their deployment channel and upgrade path. Refer to the Adobe Product Security Advisory for the authoritative patch matrix.

Workarounds

Place Adobe Campaign Classic behind a reverse proxy or web application firewall with rules that block suspicious template or script syntax in request bodies.
Enforce network segmentation so Campaign Classic servers cannot reach systems outside their required integration scope.
Run the Campaign Classic service under a least-privileged account with restricted file-system and network permissions to reduce the blast radius if exploited.

bash

# Example: restrict inbound access to Campaign Classic to a trusted admin subnet (Linux iptables)
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP