CVE-2026-82003: Adobe Campaign Classic RCE Vulnerability

CVE-2026-82003 Overview

Adobe Campaign Classic (ACC) contains an improper input validation vulnerability [CWE-20] that enables arbitrary code execution in the context of the current user. A low-privileged attacker can exploit this flaw over the network without user interaction. Successful exploitation causes a scope change, allowing the attacker to affect resources beyond the vulnerable component's security boundary. Adobe published security bulletin APSB26-142 addressing affected Campaign Classic builds including 7.4.4-9400 and 7.4.4-9401. Exploitation depends on conditions beyond the attacker's control, which raises attack complexity but does not eliminate risk in production deployments.

Critical Impact
Successful exploitation grants arbitrary code execution on the Campaign Classic host with impact extending beyond the vulnerable component due to the changed scope.

Affected Products

Adobe Campaign Classic 7.4.4-9400
Adobe Campaign Classic 7.4.4-9401
Adobe Campaign Classic deployments on Linux and Microsoft Windows

Discovery Timeline

2026-09-22 - CVE-2026-82003 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-82003

Vulnerability Analysis

Adobe Campaign Classic fails to properly validate input processed by the application, classified under [CWE-20] Improper Input Validation. An authenticated attacker with low privileges can submit crafted input that the application processes without sufficient sanitization. The resulting arbitrary code execution runs in the context of the current user of the Campaign Classic process. Because the CVSS scope is changed, the impact extends beyond the vulnerable component and can affect adjacent resources such as backing databases, connected marketing systems, and downstream integrations. Adobe describes the exploitation as conditional, meaning attackers must satisfy environmental or configuration prerequisites. Once those prerequisites are met, the attack chain does not require any user interaction, making automated exploitation attempts feasible against exposed instances.

Root Cause

The root cause is missing or insufficient validation of attacker-controlled input on a code path reachable by low-privileged authenticated users. Adobe has not published the specific parameter or component that fails validation. See the Adobe Campaign Security Update APSB26-142 for vendor details.

Attack Vector

The vulnerability is exploitable over the network against Campaign Classic deployments. An attacker requires low-privileged credentials on the target instance. After authenticating, the attacker sends crafted input that triggers the input validation flaw and achieves code execution as the running Campaign user. The changed scope indicates the executed code can pivot into other trust boundaries, such as service accounts, database contexts, or integrated Adobe Experience Cloud resources.

No public proof-of-concept or verified exploit code is available at this time. Refer to the vendor advisory for technical details before authoring detections.

Detection Methods for CVE-2026-82003

Indicators of Compromise

Unexpected child processes spawned by Adobe Campaign Classic service accounts, including shell interpreters (cmd.exe, powershell.exe, /bin/sh, /bin/bash) launched from the ACC process tree.
Outbound network connections from Campaign Classic hosts to unfamiliar external destinations following authenticated API or console activity.
Anomalous write operations to Campaign installation directories or to system paths writable by the Campaign service user.
Authentication events from low-privileged Campaign accounts immediately preceding process or file system anomalies.

Detection Strategies

Baseline expected process lineage for Campaign Classic services and alert on deviations that resemble command execution or scripting activity.
Correlate authentication logs from ACC with endpoint process telemetry to surface suspicious sequences from low-privileged accounts.
Inspect HTTP request bodies to Campaign Classic endpoints for unusually large payloads, encoded content, or malformed parameters that could indicate exploitation attempts.

Monitoring Recommendations

Forward Adobe Campaign Classic application, web server, and operating system logs to a centralized analytics platform for correlation.
Monitor privileged actions initiated by low-privileged Campaign users, including workflow execution, script activity, and data export operations.
Track outbound egress from Campaign Classic servers and alert on connections outside approved integration endpoints.

How to Mitigate CVE-2026-82003

Immediate Actions Required

Apply the update referenced in Adobe security bulletin APSB26-142 to all Campaign Classic instances, prioritizing internet-facing deployments.
Inventory Campaign Classic hosts and confirm build numbers, focusing on 7.4.4-9400 and 7.4.4-9401 and earlier affected releases.
Rotate credentials for Campaign Classic operator accounts and service accounts that could have been used to reach the vulnerable code path.
Review recent authentication and workflow execution logs for evidence of exploitation activity.

Patch Information

Adobe released fixed builds for Adobe Campaign Classic as documented in the Adobe Campaign Security Update APSB26-142. Administrators should follow Adobe's upgrade guidance and validate the patched build in a staging environment before promoting to production.

Workarounds

Restrict network access to Campaign Classic consoles and APIs to trusted management networks using firewall or VPN controls until patching completes.
Enforce least privilege on Campaign Classic accounts and remove unused low-privileged operator credentials that could serve as an initial access foothold.
Enable multi-factor authentication on all Campaign Classic accounts to reduce the risk of credential-based access to the vulnerable code path.

bash

# Example: restrict inbound access to Campaign Classic to a management subnet (Linux, iptables)
iptables -A INPUT -p tcp --dport 8080 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP