CVE-2026-76195: Adobe Campaign Classic RCE Vulnerability

CVE-2026-76195 Overview

CVE-2026-76195 is an OS command injection vulnerability [CWE-78] in Adobe Campaign Classic (ACC). The flaw stems from improper neutralization of special elements passed to operating system commands. An unauthenticated remote attacker can exploit this issue over the network without user interaction. Successful exploitation results in arbitrary code execution in the context of the current user. The vulnerability causes a scope change, meaning impact extends beyond the vulnerable component to other resources.

Critical Impact
Unauthenticated attackers can execute arbitrary OS commands remotely on Adobe Campaign Classic servers, leading to full compromise of the marketing automation environment and connected systems.

Affected Products

Adobe Campaign Classic (ACC)
Refer to Adobe Security Advisory APSB26-134 for specific version ranges
Deployments where ACC processes untrusted network input

Discovery Timeline

2026-08-25 - CVE-2026-76195 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76195

Vulnerability Analysis

Adobe Campaign Classic fails to neutralize special characters supplied to functions that construct OS command strings. When attacker-controlled input reaches a shell interpreter or command execution primitive, injected metacharacters (such as ;, |, &, backticks, or $()) are interpreted as command separators. The attacker's payload then executes alongside the intended command with the privileges of the ACC process account.

The advisory notes a scope change, indicating that exploitation crosses a security boundary. Command execution in the ACC process context can pivot to database servers, integrated CRM systems, and customer data stores that the campaign platform touches.

Root Cause

The root cause is missing or insufficient input sanitization before constructing OS commands, classified as [CWE-78] Improper Neutralization of Special Elements used in an OS Command. ACC concatenates untrusted values into command strings rather than using safe parameterized execution APIs. This design pattern breaks the boundary between data and code.

Attack Vector

Exploitation requires only network access to a vulnerable Adobe Campaign Classic instance. No authentication, privileges, or user interaction are needed. An attacker sends a crafted request containing shell metacharacters embedded in a parameter that ACC forwards to an OS command. The injected commands run under the user context of the ACC service.

Because no verified public proof-of-concept exists at time of publication, defenders should treat internet-exposed ACC endpoints as high-priority remediation targets. See the Adobe Security Advisory APSB26-134 for vendor-provided technical details.

Detection Methods for CVE-2026-76195

Indicators of Compromise

Unexpected child processes spawned by the Adobe Campaign Classic service account, such as cmd.exe, powershell.exe, /bin/sh, or bash
Outbound network connections from ACC hosts to unfamiliar external IP addresses or command-and-control infrastructure
New scheduled tasks, cron jobs, or service entries created shortly after inbound HTTP requests to ACC
Web server or application logs containing shell metacharacters (;, |, &&, `, $()) in request parameters

Detection Strategies

Monitor process ancestry to identify shell interpreters descending from ACC application or web server processes
Deploy web application firewall rules that flag OS command metacharacters in requests to ACC endpoints
Correlate anomalous outbound network activity from ACC hosts with recent inbound HTTP traffic patterns
Review authentication and privilege changes across systems that ACC integrates with, including databases and CRMs

Monitoring Recommendations

Ingest ACC application, web server, and OS audit logs into a centralized SIEM for cross-source correlation
Enable command-line auditing on Windows (Event ID 4688) and execve auditing on Linux to capture full command arguments
Alert on any interactive shell or scripting engine execution originating from the ACC service user
Baseline normal ACC network egress and alert on deviations, particularly connections to file-sharing or paste services

How to Mitigate CVE-2026-76195

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-134 as the primary remediation
Restrict network exposure of Adobe Campaign Classic administrative and API endpoints to trusted networks only
Audit ACC service account privileges and reduce them to the minimum required for operation
Review recent ACC and host logs for indicators consistent with command injection exploitation attempts

Patch Information

Adobe published fixes for CVE-2026-76195 in security advisory APSB26-134. Administrators should identify their installed ACC version, consult the advisory for the corresponding fixed build, and schedule expedited deployment. Verify patch application by confirming the updated version string in the ACC console after installation.

Workarounds

Place a web application firewall in front of ACC and block requests containing shell metacharacters in parameters that reach command-execution code paths
Enforce network segmentation so ACC cannot initiate outbound connections to arbitrary internet destinations
Disable or restrict any ACC features that invoke OS commands with user-supplied input until the patch is applied
Increase logging verbosity on ACC and its host to support rapid investigation while the patch is pending

bash

# Example: restrict outbound egress from an ACC host to an allow-list using iptables
iptables -A OUTPUT -d <allowed_partner_ip> -j ACCEPT
iptables -A OUTPUT -d <internal_db_subnet> -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -j DROP