CVE-2026-82004: Adobe Campaign Classic RCE Vulnerability

CVE-2026-82004 Overview

Adobe Campaign Classic (ACC) contains an OS Command Injection vulnerability [CWE-78] that allows unauthenticated attackers to execute arbitrary operating system commands. The flaw stems from improper neutralization of special elements passed to underlying shell commands. Exploitation requires no user interaction and no privileges. A successful attack changes the security scope and grants code execution in the context of the current user. Adobe published advisory APSB26-142 to address the issue across affected Campaign Classic builds.

Critical Impact
Remote, unauthenticated attackers can execute arbitrary OS commands against Adobe Campaign Classic instances reachable over the network, resulting in full compromise of the marketing automation environment and any connected customer data.

Affected Products

Adobe Campaign Classic (ACC) — all versions prior to the APSB26-142 fix
Adobe Campaign Classic 7.4.4 build 9400
Adobe Campaign Classic 7.4.4 build 9401

Discovery Timeline

2026-09-08 - CVE-2026-82004 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-82004

Vulnerability Analysis

Adobe Campaign Classic exposes application functionality that constructs OS-level commands using attacker-influenced input. The application fails to sanitize shell metacharacters before passing values to the operating system. An attacker who reaches the vulnerable endpoint over the network can inject additional commands that execute alongside the intended process. Because the scope changes on exploitation, the impact extends beyond the vulnerable component into other resources controlled by the host, including databases, campaign data, and integrated systems. The vulnerability carries an EPSS probability of 1.437%, placing it in the 71st percentile for likelihood of exploitation activity.

Root Cause

The defect is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command. Campaign Classic concatenates user-controlled data into command strings executed by a shell interpreter without escaping characters such as ;, |, &, backticks, or $(). This anti-pattern allows attacker payloads to break out of the intended argument context and run separate commands with the privileges of the Campaign service account.

Attack Vector

The attack vector is network-based and does not require authentication or user interaction. An attacker sends a crafted request to a vulnerable Campaign Classic endpoint containing shell metacharacters in a field that feeds into an OS command. The server executes both the intended command and the injected payload. On typical deployments the Campaign service runs with sufficient privilege to read configuration files, exfiltrate marketing databases, and pivot into adjacent infrastructure. Refer to the Adobe Security Update APSB26-142 for vendor-supplied technical context.

Detection Methods for CVE-2026-82004

Indicators of Compromise

Unexpected child processes spawned by the Adobe Campaign application service, such as sh, bash, cmd.exe, or powershell.exe.
Outbound network connections from Campaign servers to unfamiliar destinations shortly after HTTP requests containing shell metacharacters.
New or modified files in Campaign install directories, temporary paths, or web-accessible folders that were not deployed by administrators.

Detection Strategies

Inspect web server and application logs for requests containing ;, |, &&, backticks, or $( in parameters processed by Campaign Classic endpoints.
Build process-lineage detections that alert when the Campaign service process spawns interpreters or reconnaissance utilities such as whoami, net.exe, or curl.
Correlate authentication-free requests with subsequent process execution or outbound traffic to identify exploitation attempts against exposed instances.

Monitoring Recommendations

Enable command-line auditing on Campaign hosts and forward events to a centralized analytics platform for retention and query.
Baseline normal outbound traffic from Campaign servers and alert on deviations, particularly to newly registered domains or raw IP addresses.
Monitor file integrity across Campaign installation directories, scheduled task stores, and startup locations to catch persistence attempts.

How to Mitigate CVE-2026-82004

Immediate Actions Required

Apply the fixed builds referenced in the Adobe Security Update APSB26-142 advisory as the primary remediation.
Restrict network access to Campaign Classic administrative and API endpoints to trusted management networks and VPN clients only.
Rotate credentials, API keys, and integration secrets stored on Campaign servers if exploitation cannot be ruled out.

Patch Information

Adobe released fixed builds for Adobe Campaign Classic under advisory APSB26-142. Administrators running Campaign Classic 7.4.4 builds 9400 and 9401, as well as earlier releases, must upgrade to the version identified in the advisory. Review the Adobe Security Update APSB26-142 for build numbers, download locations, and installation prerequisites.

Workarounds

Place a web application firewall (WAF) in front of Campaign Classic and block requests containing shell metacharacters in parameters that reach vulnerable endpoints.
Remove Campaign Classic from direct internet exposure until the patch is deployed, permitting access only through authenticated reverse proxies.
Run the Campaign service under a least-privilege account with restricted file system, database, and outbound network permissions to limit blast radius.

bash

# Example WAF rule concept: block shell metacharacters in query and body parameters
# Adjust to your WAF syntax (ModSecurity example)
SecRule ARGS "@rx [;&|`$()]" \
    "id:1002026,phase:2,deny,status:400,log,msg:'Potential OS command injection targeting Adobe Campaign (CVE-2026-82004)'"