CVE-2026-82008: Adobe Campaign Classic RCE Vulnerability

CVE-2026-82008 Overview

CVE-2026-82008 affects Adobe Campaign Classic (ACC), a marketing automation platform used for cross-channel customer engagement. The flaw stems from improper input validation [CWE-20] that allows arbitrary code execution in the context of the current user. A low-privileged attacker can exploit the issue over the network without user interaction, and the scope is changed, meaning impact extends beyond the vulnerable component.

Critical Impact
A low-privileged, remote attacker can execute arbitrary code on Adobe Campaign Classic deployments and pivot beyond the application boundary due to the changed CVSS scope.

Affected Products

Adobe Campaign Classic (ACC) versions up to and including 7.4.4 builds 9400 and 9401
Adobe Campaign Classic on Linux platforms
Adobe Campaign Classic on Microsoft Windows platforms

Discovery Timeline

2026-09-22 - CVE-2026-82008 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database
2026-09-22 - Adobe Security Bulletin APSB26-142 published

Technical Details for CVE-2026-82008

Vulnerability Analysis

Adobe Campaign Classic fails to properly validate input supplied to an exposed application interface. The improper validation [CWE-20] allows an attacker holding low-level application credentials to submit crafted data that the server subsequently processes as executable content. Execution occurs under the identity of the current user running the Campaign Classic service, which typically holds elevated rights to campaign data, execution scripts, and integrations with downstream marketing and customer databases.

The changed CVSS scope indicates that successful exploitation impacts resources managed outside the vulnerable component's security authority. In Adobe Campaign deployments, this commonly includes backend databases, SMTP delivery infrastructure, and connected identity stores.

Root Cause

The root cause is missing or insufficient input validation on data accepted by an ACC interface. Attacker-controlled input reaches a code execution sink without adequate sanitization, type checking, or allowlisting. Consult the Adobe advisory APSB26-142 for component-level detail.

Attack Vector

Exploitation requires network access to the ACC application and a low-privileged authenticated session. No user interaction is required. An attacker submits crafted input through a network-accessible endpoint; the server processes the input and executes attacker-controlled logic. Once code execution is achieved, the attacker can access marketing data, credentials stored for outbound integrations, and lateral movement targets reachable from the ACC host.

No public proof-of-concept has been published and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of publication. The EPSS score is 1.216% (percentile 67.254).

Detection Methods for CVE-2026-82008

Indicators of Compromise

Unexpected child processes spawned by the Adobe Campaign Classic service account on Windows or Linux hosts
Outbound network connections from ACC hosts to unfamiliar external destinations following authenticated user activity
Anomalous script or workflow objects created within Campaign Classic by low-privileged operator accounts
New or modified files in ACC installation and temporary directories that do not correlate to a scheduled deployment

Detection Strategies

Monitor authentication logs for low-privileged accounts performing unusual API calls or workflow submissions to the ACC application server
Alert on process lineage where the ACC service process spawns interpreters such as cmd.exe, powershell.exe, /bin/sh, or python
Correlate ACC application logs with EDR telemetry to identify input payloads that precede execution events

Monitoring Recommendations

Enable verbose logging on ACC application endpoints and forward logs to a centralized SIEM for retention and correlation
Baseline normal API and workflow activity for each operator role, then alert on deviations
Monitor egress network traffic from ACC servers for connections outside documented integration partners

How to Mitigate CVE-2026-82008

Immediate Actions Required

Apply the security update referenced in Adobe Security Bulletin APSB26-142 to all Adobe Campaign Classic installations
Inventory ACC operator accounts and revoke or reduce privileges for accounts no longer required
Restrict network access to ACC application endpoints to trusted management networks and required integration hosts
Review recent operator activity for signs of exploitation before patching

Patch Information

Adobe published fixes in Security Bulletin APSB26-142. Administrators running Adobe Campaign Classic 7.4.4 builds 9400 and 9401, or earlier, must upgrade to the version identified as fixed in the vendor advisory. Confirm build numbers after upgrade using the ACC administration console.

Workarounds

Place the ACC application server behind a reverse proxy or Web Application Firewall (WAF) and enforce strict allowlists for input parameters where feasible
Disable or restrict operator accounts and API keys that are not required for business operations until patching completes
Segment the ACC server from general corporate networks and require VPN or bastion access for administration

bash

# Example: restrict ACC network exposure with iptables until patched
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP