CVE-2026-76197: Adobe Campaign Classic RCE Vulnerability

CVE-2026-76197 Overview

Adobe Campaign Classic (ACC) contains an OS Command Injection vulnerability [CWE-78] that enables arbitrary code execution in the context of the current user. The flaw stems from improper neutralization of special elements passed to operating system commands. An unauthenticated remote attacker can exploit this weakness across the network without user interaction. The vulnerability also causes a scope change, meaning successful exploitation impacts resources beyond the vulnerable component's security authority.

Critical Impact
Remote unauthenticated attackers can execute arbitrary OS commands on Adobe Campaign Classic servers, leading to full system compromise and lateral movement across trust boundaries.

Affected Products

Adobe Campaign Classic (ACC)
Refer to Adobe Security Advisory APSB26-134 for specific affected versions
On-premise and hosted ACC deployments within the vendor-defined version range

Discovery Timeline

2026-08-25 - CVE-2026-76197 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-76197

Vulnerability Analysis

The vulnerability resides in Adobe Campaign Classic's handling of user-supplied input that is subsequently passed to operating system command interpreters. Because ACC fails to properly neutralize shell metacharacters, an attacker can inject arbitrary commands that execute with the privileges of the ACC service account. The scope change indicator signals that a successful exploit crosses a security boundary, allowing an attacker to affect components outside the vulnerable module itself. Adobe Campaign Classic frequently runs with elevated service privileges and holds sensitive marketing, customer, and personally identifiable information (PII), making command execution a direct path to broad data compromise.

Root Cause

The root cause is improper neutralization of special elements used in an OS command, categorized as [CWE-78]. Input handled by the application reaches a command execution sink without sufficient sanitization, escaping, or use of parameterized APIs. Shell metacharacters such as ;, |, &, and backticks are interpreted by the underlying operating system rather than treated as literal data.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to an exposed ACC endpoint containing injected command syntax. The Adobe advisory APSB26-134 documents the affected components and remediated versions. Because the vulnerability yields code execution in the current user context, an attacker can subsequently attempt privilege escalation, credential theft, or pivot to backend databases containing campaign and customer data.

No verified proof-of-concept code is publicly available. Refer to the Adobe Security Advisory APSB26-134 for authoritative technical guidance.

Detection Methods for CVE-2026-76197

Indicators of Compromise

Unexpected child processes spawned by the ACC application service, such as cmd.exe, powershell.exe, /bin/sh, or /bin/bash.
HTTP request logs containing shell metacharacters (;, |, &&, backticks, $()) within ACC parameter values.
Outbound network connections from the ACC host to unrecognized external addresses following anomalous request activity.
New or modified files in ACC installation directories, particularly executables or scripts written by the service account.

Detection Strategies

Deploy behavioral endpoint monitoring on ACC servers to identify command interpreter execution originating from the ACC process tree.
Enable verbose HTTP request logging on ACC front-end services and alert on payloads matching OS command injection patterns.
Correlate web request telemetry with process creation events to identify request-to-execution chains characteristic of injection attacks.

Monitoring Recommendations

Monitor ACC service accounts for anomalous authentication, file access, or lateral movement activity.
Track outbound egress traffic from ACC hosts and flag connections to non-approved destinations.
Enable file integrity monitoring on ACC binaries, configuration files, and web-accessible directories.

How to Mitigate CVE-2026-76197

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-134 to all Adobe Campaign Classic instances without delay.
Restrict network access to ACC management and application endpoints to trusted administrative networks only.
Audit ACC service account privileges and enforce least privilege for the process runtime user.
Review web server and application logs for exploitation attempts predating patch deployment.

Patch Information

Adobe has released fixed versions of Adobe Campaign Classic addressing this vulnerability. Refer to Adobe Security Advisory APSB26-134 for the exact patched builds and upgrade procedures applicable to on-premise and hosted deployments.

Workarounds

Place ACC application endpoints behind a web application firewall (WAF) with rules blocking OS command injection payloads.
Isolate ACC servers in a segmented network zone with strict ingress and egress filtering.
Disable or restrict access to any ACC features not required for production workflows to reduce attack surface.

bash

# Example WAF rule concept to block common OS command injection metacharacters
# Adapt to your specific WAF syntax (ModSecurity example)
SecRule ARGS "@rx (?:;|\||&&|`|\$\(|\|\|)" \
    "id:1076197,phase:2,deny,status:403,\
    msg:'Potential OS command injection targeting Adobe Campaign Classic (CVE-2026-76197)'"