CVE-2026-75703: Adobe Campaign Classic RCE Vulnerability

CVE-2026-75703 Overview

Adobe Campaign Classic (ACC) contains a code injection vulnerability [CWE-94] that allows attackers to execute arbitrary code in the context of the current user. The flaw stems from improper control of code generation within the application. Exploitation requires no user interaction and no authentication, and the scope is changed, meaning the impact extends beyond the vulnerable component. Adobe published security advisory APSB26-142 addressing this issue in affected 7.4.4 builds. The vulnerability carries a maximum severity rating and affects deployments on both Linux and Microsoft Windows platforms.

Critical Impact
Unauthenticated attackers can execute arbitrary code remotely across the network, with scope change enabling lateral impact beyond the Adobe Campaign Classic process boundary.

Affected Products

Adobe Campaign Classic version 7.4.4 build 9400
Adobe Campaign Classic version 7.4.4 build 9401
Adobe Campaign Classic deployments on Linux and Microsoft Windows

Discovery Timeline

2026-09-22 - CVE-2026-75703 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-75703

Vulnerability Analysis

Adobe Campaign Classic is an enterprise cross-channel marketing platform used for campaign orchestration, customer data management, and message delivery. The flaw is classified under CWE-94: Improper Control of Generation of Code. Code injection weaknesses arise when an application constructs code from untrusted input without sufficient validation. Attackers who supply crafted input can cause the application to interpret that input as executable code. In Adobe Campaign Classic, this results in arbitrary code execution under the privileges of the current user account running the affected component.

The scope change indicator signals that a successful exploit affects resources beyond the vulnerable component's security authority. In practical terms, an attacker can pivot from the Campaign application to adjacent services, databases, or the underlying operating system context. The Exploit Prediction Scoring System places this vulnerability at 1.248% probability with a 68.04 percentile ranking, indicating above-average likelihood of exploitation activity relative to the broader CVE population.

Root Cause

The root cause is the application's failure to enforce a strict boundary between data and executable code paths during processing of network-supplied input. When Adobe Campaign Classic evaluates or compiles input received over the network, insufficient sanitization allows attacker-controlled content to reach a code interpretation sink. This pattern is common in template engines, scripting bridges, and dynamic expression evaluators embedded in enterprise applications.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network reachability to a vulnerable Adobe Campaign Classic server can transmit a crafted request that triggers the code injection. Because scope is changed, execution can affect components outside the immediate process, including backend databases, integration endpoints, or the host operating system depending on service account privileges. Refer to the Adobe Security Advisory APSB26-142 for vendor-specific technical details.

No public proof-of-concept exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of publication.

Detection Methods for CVE-2026-75703

Indicators of Compromise

Unexpected child processes spawned by the Adobe Campaign Classic service account, particularly command interpreters such as cmd.exe, powershell.exe, or /bin/sh
Outbound network connections from the Campaign server to unfamiliar hosts following inbound HTTP or application-layer traffic
New or modified files under Adobe Campaign installation directories or web-accessible paths that were not deployed by administrators
Anomalous entries in Adobe Campaign application logs showing malformed input to expression or scripting endpoints

Detection Strategies

Deploy behavioral endpoint monitoring on Campaign Classic hosts to flag process lineage anomalies where the application spawns interactive shells or scripting hosts
Enable verbose application logging and forward Adobe Campaign logs to a centralized SIEM for correlation against network telemetry
Apply web application firewall rules that inspect requests to Campaign endpoints for injection patterns, scripting keywords, and abnormal payload sizes

Monitoring Recommendations

Baseline normal process activity for the Adobe Campaign service account and alert on deviations
Monitor authentication logs and privileged account use on hosts running Campaign Classic for unexpected escalation
Track outbound egress from Campaign servers, restricting flows to known integration partners and blocking unclassified destinations

How to Mitigate CVE-2026-75703

Immediate Actions Required

Identify all Adobe Campaign Classic deployments running version 7.4.4 builds 9400 and 9401 and prioritize them for patching
Restrict network exposure of Adobe Campaign Classic servers to trusted management networks until patches are applied
Review service account privileges for Campaign Classic and apply least-privilege principles to limit blast radius of any successful exploitation
Audit recent logs for indicators of exploitation attempts against Campaign endpoints

Patch Information

Adobe has released a security update addressing this vulnerability. Consult the Adobe Security Advisory APSB26-142 for the fixed build numbers and vendor upgrade guidance. Apply the vendor-supplied update to all affected Campaign Classic instances as the primary remediation.

Workarounds

Place Adobe Campaign Classic servers behind a web application firewall configured to inspect and filter injection payloads
Segment Campaign Classic hosts on isolated network zones with strict ingress and egress controls
Disable or restrict access to any Campaign features that evaluate dynamic expressions or scripting where operationally feasible
Enforce authentication and IP allowlisting at the network perimeter for any exposed Campaign management interfaces