CVE-2026-75728 Overview
Adobe Campaign Classic (ACC) contains an Incorrect Authorization vulnerability [CWE-863] that allows attackers to execute arbitrary code in the context of the current user. The flaw is reachable over the network without authentication and requires no user interaction. Adobe disclosed the issue in security bulletin APSB26-142 and confirmed impact to Adobe Campaign Classic versions 7.4.4-9400 and 7.4.4-9401. Because Adobe Campaign Classic is deployed on both Linux and Windows hosts, both operating system environments are within scope. Successful exploitation gives an attacker the ability to run code with the privileges of the running Campaign process.
Critical Impact
Unauthenticated network attackers can trigger arbitrary code execution against exposed Adobe Campaign Classic instances without any user interaction.
Affected Products
- Adobe Campaign Classic (ACC) 7.4.4-9400
- Adobe Campaign Classic (ACC) 7.4.4-9401
- Adobe Campaign Classic deployments on Linux and Microsoft Windows hosts
Discovery Timeline
- 2026-09-22 - CVE-2026-75728 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-75728
Vulnerability Analysis
CVE-2026-75728 is an Incorrect Authorization weakness classified under [CWE-863]. The Adobe Campaign Classic application fails to properly enforce authorization checks on a network-reachable code path. An attacker can reach a privileged operation without presenting valid credentials or belonging to an authorized role. Because the reachable operation performs actions influenced by attacker-controlled input, the missing authorization results in arbitrary code execution rather than only data exposure. Adobe has classified the issue as critical and released fixed builds through security bulletin APSB26-142.
Root Cause
The root cause is an authorization check that does not correctly validate the caller's identity or entitlements before executing a sensitive action. Under [CWE-863], the software performs an authorization decision using flawed logic, allowing an unauthenticated actor to invoke a function reserved for privileged users. In Adobe Campaign Classic, this authorization gap sits in front of functionality that ultimately executes code within the application server context.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker with reachability to the Adobe Campaign Classic application endpoint sends a crafted request that invokes the improperly gated operation. Because the vulnerable Campaign application typically runs as a service account on Linux or Windows, executed code inherits those privileges. Exploitation does not depend on chaining a second vulnerability. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
// No verified proof-of-concept is available. See the
// Adobe Security Bulletin APSB26-142 for vendor guidance.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-75728
Indicators of Compromise
- Unexpected child processes spawned by the Adobe Campaign Classic application service on Linux or Windows hosts.
- Outbound network connections from the Campaign server to unfamiliar external addresses immediately following unauthenticated inbound HTTP requests.
- New or modified files under the Campaign installation directory that were not deployed as part of a scheduled release.
Detection Strategies
- Inspect Adobe Campaign Classic application and web-tier logs for requests to privileged endpoints that lack an authenticated session identifier.
- Correlate process creation events on Campaign hosts with the parent Campaign service to identify shell interpreters or scripting engines launched outside normal operations.
- Baseline legitimate Campaign administrative traffic and alert on deviations from expected source addresses, user agents, and request patterns.
Monitoring Recommendations
- Forward Campaign server logs, host process telemetry, and network flow data to a centralized analytics platform for correlation.
- Monitor for privilege-sensitive API calls occurring without preceding authentication events in the same session.
- Track file integrity on the Campaign application directories and configuration files, alerting on unauthorized modification.
How to Mitigate CVE-2026-75728
Immediate Actions Required
- Apply the fixed Adobe Campaign Classic build referenced in Adobe Security Bulletin APSB26-142 as soon as feasible.
- Restrict network access to Adobe Campaign Classic management interfaces so that only trusted administrative networks can reach them.
- Review Campaign application and host logs for signs of exploitation attempts predating the patch deployment.
Patch Information
Adobe has published fixed versions of Adobe Campaign Classic through the Adobe Security Bulletin APSB26-142. Administrators should follow the vendor upgrade procedure for their specific ACC deployment topology, including any post-upgrade validation steps documented by Adobe.
Workarounds
- Place Adobe Campaign Classic behind a reverse proxy or web application firewall that enforces authentication before requests reach the application server.
- Segment Campaign servers into a restricted network zone and block direct internet exposure of the application endpoint.
- Enforce least privilege on the operating system account that runs the Campaign service to reduce the impact of code execution.
# Example: restrict inbound access to the Campaign application port
# Replace <trusted_admin_cidr> and <acc_port> with environment-specific values
iptables -A INPUT -p tcp --dport <acc_port> -s <trusted_admin_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport <acc_port> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
