CVE-2026-75721: Adobe Campaign Classic RCE Vulnerability

CVE-2026-75721 Overview

Adobe Campaign Classic (ACC) contains a code injection vulnerability [CWE-94] that allows attackers to execute arbitrary code in the context of the current user. The flaw stems from improper control of code generation within the application. An unauthenticated attacker can exploit this issue over the network without user interaction. The scope is changed, meaning successful exploitation impacts resources beyond the vulnerable component. Adobe published security advisory APSB26-142 addressing this vulnerability in Adobe Campaign Classic versions 7.4.4:9400 and 7.4.4:9401.

Critical Impact

Unauthenticated remote code execution with changed scope enables full compromise of Adobe Campaign Classic deployments and connected resources.

Affected Products

• Adobe Campaign Classic version 7.4.4:9400
• Adobe Campaign Classic version 7.4.4:9401
• Deployments running on Linux and Microsoft Windows platforms

Discovery Timeline

• 2026-09-22 - CVE-2026-75721 published to the National Vulnerability Database
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-75721

Vulnerability Analysis

The vulnerability is classified as Improper Control of Generation of Code, commonly known as Code Injection [CWE-94]. Adobe Campaign Classic constructs or evaluates code from data that an attacker can influence. When the application processes attacker-controlled input during code generation, the input is interpreted as executable instructions. This allows arbitrary code execution within the process context of the current user running the Adobe Campaign Classic service.

The changed scope indicator means the vulnerability affects resources beyond the vulnerable component itself. An attacker exploiting this flaw can pivot to backend databases, marketing automation pipelines, and connected customer data repositories that Adobe Campaign integrates with.

Root Cause

The root cause is insufficient validation and sanitization of input used in dynamic code generation. Adobe Campaign Classic exposes server-side scripting and workflow processing capabilities that evaluate expressions at runtime. When untrusted data reaches these evaluation paths without proper isolation, injected payloads execute with the privileges of the campaign service account.

Attack Vector

Exploitation occurs over the network. The attacker requires no prior authentication and no user interaction. An attacker sends a crafted request to an exposed Adobe Campaign Classic endpoint containing an injected payload. The application evaluates the payload during code generation, executing arbitrary commands on the underlying operating system. Because Adobe Campaign Classic deployments typically hold marketing databases, customer PII, and email delivery infrastructure, successful exploitation grants access to sensitive business assets.

No public proof-of-concept exploit or CISA KEV listing exists at the time of publication. Refer to the Adobe Security Advisory APSB26-142 for vendor-specific technical details.

Detection Methods for CVE-2026-75721

Indicators of Compromise

• Unexpected child processes spawned by the Adobe Campaign Classic service account, particularly shells such as cmd.exe, powershell.exe, or /bin/sh
• Anomalous outbound network connections from Adobe Campaign servers to unfamiliar IP addresses or domains
• Unauthorized modifications to Adobe Campaign workflow definitions, JavaScript activities, or scheduled tasks
• New or modified files in Adobe Campaign installation directories that do not match vendor-supplied artifacts

Detection Strategies

• Inspect Adobe Campaign application logs for malformed workflow expressions and script evaluation errors preceding successful requests
• Monitor HTTP request bodies to /nl/jsp/ and SOAP endpoints for suspicious payloads containing script delimiters or eval constructs
• Deploy endpoint detection tooling on Adobe Campaign hosts to identify process lineage anomalies from the campaign service
• Correlate authentication logs with process execution events to identify unauthenticated request flows resulting in code execution

Monitoring Recommendations

• Enable verbose logging on Adobe Campaign application servers and forward logs to a centralized SIEM for correlation
• Establish behavioral baselines for the Adobe Campaign service account and alert on deviations in process creation and network egress
• Monitor file integrity on Adobe Campaign binaries, configuration files, and workflow storage directories

How to Mitigate CVE-2026-75721

Immediate Actions Required

• Apply the security update published in Adobe Security Advisory APSB26-142 to all Adobe Campaign Classic instances
• Inventory all Adobe Campaign Classic deployments including versions 7.4.4:9400 and 7.4.4:9401 and prioritize internet-exposed instances
• Restrict network access to Adobe Campaign Classic administrative and API endpoints using firewall rules and reverse proxy allowlists
• Review Adobe Campaign audit logs and workflow definitions for unauthorized changes following the vulnerability disclosure window

Patch Information

Adobe released the fix through security bulletin APSB26-142. Administrators should upgrade Adobe Campaign Classic to the fixed version identified in the advisory. Test the update in a staging environment before applying to production marketing infrastructure to validate workflow compatibility.

Workarounds

• Place Adobe Campaign Classic servers behind a web application firewall configured to block script and eval patterns in request payloads
• Segment Adobe Campaign infrastructure from other production systems to limit lateral movement if exploitation occurs
• Disable or restrict any unused Adobe Campaign Classic endpoints and workflow activities that accept dynamic scripting input

# Configuration example: restrict inbound access to Adobe Campaign
# using iptables until the patch from APSB26-142 is applied
iptables -A INPUT -p tcp --dport 443 -s <trusted_admin_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP