CVE-2026-75723: Adobe Campaign Classic RCE Vulnerability

CVE-2026-75723 Overview

Adobe Campaign Classic (ACC) contains an Incorrect Authorization vulnerability [CWE-863] that allows an unauthenticated attacker to execute arbitrary code in the context of the current user. The flaw is reachable over the network, requires no privileges, and requires no user interaction. Successful exploitation changes scope, meaning the impact extends beyond the vulnerable component to other resources on the host. Affected releases include Adobe Campaign Classic versions 7.4.4:9400 and 7.4.4:9401 on both Linux and Windows platforms. Adobe published fixed builds in security advisory APSB26-142.

Critical Impact

Unauthenticated remote code execution with scope change enables full compromise of Adobe Campaign Classic hosts and lateral movement into connected marketing, customer, and identity data stores.

Affected Products

• Adobe Campaign Classic 7.4.4 build 9400
• Adobe Campaign Classic 7.4.4 build 9401
• Adobe Campaign Classic deployments on Linux and Microsoft Windows

Discovery Timeline

• 2026-09-22 - CVE-2026-75723 published to the National Vulnerability Database
• 2026-09-23 - Record last modified in NVD

Technical Details for CVE-2026-75723

Vulnerability Analysis

Adobe Campaign Classic fails to correctly enforce authorization checks on a network-reachable code path. An attacker who reaches the ACC service can invoke privileged functionality without presenting valid credentials. Because the vulnerable path leads to code execution primitives, the attacker gains the ability to run arbitrary commands under the identity of the ACC process account.

The scope change property indicates the vulnerability lets the attacker cross a trust boundary. Code that runs after exploitation is not confined to the ACC application context and can act on other components, including the operating system, connected databases, and any credentials held by the ACC service.

Exploitation of Incorrect Authorization flaws in campaign management platforms typically pivots into large repositories of personally identifiable information (PII), delivery infrastructure, and integrated marketing tooling. Attackers can weaponize compromised ACC installations to send authenticated communications from trusted domains.

Root Cause

The root cause is an authorization check that either does not run or does not correctly validate the caller before granting access to code execution functionality. This is characteristic of [CWE-863] Incorrect Authorization, where an access control decision is made but produces the wrong result for certain requests.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends a crafted request to an exposed Adobe Campaign Classic endpoint. The request bypasses authorization and reaches functionality that executes attacker-controlled code. No user interaction is required, which allows automated mass exploitation once a working technique is public.

Adobe has not released technical exploitation details. Refer to the Adobe Security Advisory APSB26-142 for vendor guidance.

Detection Methods for CVE-2026-75723

Indicators of Compromise

• Unexpected child processes spawned by the Adobe Campaign Classic service account, particularly shells (cmd.exe, powershell.exe, /bin/sh, /bin/bash) or scripting interpreters.
• Outbound network connections from ACC hosts to unfamiliar IP addresses or newly registered domains.
• New or modified files in ACC installation directories, web-accessible paths, or scheduled task locations.
• Anomalous authentication events from ACC service accounts to databases, LDAP, or downstream mail delivery systems.

Detection Strategies

• Baseline the normal process tree of the ACC service and alert on deviations, especially interpreter launches.
• Monitor ACC HTTP endpoints for requests to administrative or internal APIs originating from untrusted networks.
• Inspect ACC application and web server logs for requests that return successful responses without a corresponding authenticated session.
• Correlate ACC host telemetry with egress traffic to identify data staging and exfiltration.

Monitoring Recommendations

• Enable verbose logging on the ACC application and forward logs to a centralized analytics platform for retention and hunting.
• Track file integrity on ACC binaries, configuration files, and template directories.
• Alert on modifications to service accounts and scheduled jobs on ACC servers.

How to Mitigate CVE-2026-75723

Immediate Actions Required

• Apply the fixed builds referenced in Adobe Security Advisory APSB26-142 as a priority.
• Inventory all Adobe Campaign Classic instances, including non-production and disaster recovery hosts, and confirm build numbers.
• Restrict network access to ACC management interfaces to trusted administrative networks only.
• Rotate credentials, API keys, and service account passwords used by ACC after patching.

Patch Information

Adobe has released updated Adobe Campaign Classic builds that address the Incorrect Authorization flaw. Consult Adobe Security Advisory APSB26-142 for the specific fixed version corresponding to your deployment and platform. Both Linux and Windows installations must be updated.

Workarounds

• Place ACC behind a reverse proxy or web application firewall that enforces authentication and restricts access to sensitive endpoints.
• Segment ACC hosts from general corporate networks and limit egress to only required destinations.
• Disable or firewall any ACC network services that are not required for operations.

# Example: restrict inbound access to ACC to a jump host subnet on Linux
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP