CVE-2026-84412: Adobe Campaign Classic RCE Vulnerability

CVE-2026-84412 Overview

CVE-2026-84412 is a code injection vulnerability affecting Adobe Campaign Classic (ACC). The flaw stems from improper control of code generation, classified under [CWE-94]. An unauthenticated attacker can exploit this vulnerability over the network to execute arbitrary code in the context of the current user. Exploitation requires no user interaction and results in a scope change, meaning the impact extends beyond the vulnerable component. Adobe has published advisory APSB26-142 addressing the issue across affected Adobe Campaign Classic versions running on Windows and Linux platforms.

Critical Impact

Unauthenticated remote code execution with scope change, granting attackers full confidentiality, integrity, and availability impact on affected Adobe Campaign Classic deployments.

Affected Products

• Adobe Campaign Classic version 7.4.4:9400
• Adobe Campaign Classic version 7.4.4:9401
• Adobe Campaign Classic deployments on Linux and Microsoft Windows

Discovery Timeline

• 2026-09-22 - CVE-2026-84412 published to the National Vulnerability Database (NVD)
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-84412

Vulnerability Analysis

CVE-2026-84412 is an Improper Control of Generation of Code vulnerability [CWE-94] in Adobe Campaign Classic. The flaw allows attacker-supplied input to influence code generation logic within the application. When exploited, the injected content executes within the process context of the current user running the Campaign Classic service.

The scope change property is significant. An attacker exploiting this vulnerability can affect resources beyond the security scope of the vulnerable component itself. This typically means the attacker breaks out of the application's security boundary and impacts other systems or user contexts.

Adobe Campaign Classic handles marketing automation workflows, customer data processing, and campaign delivery. Successful exploitation grants an attacker the ability to read customer databases, manipulate campaign content, and pivot to connected systems.

Root Cause

The root cause is insufficient sanitization or validation of input used in dynamic code generation paths within Adobe Campaign Classic. When the application processes attacker-controlled data through code interpretation or template evaluation routines, the injected payload becomes executable logic rather than inert data. Adobe has not published detailed technical specifics of the affected component.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted request to an exposed Adobe Campaign Classic endpoint. The malicious payload triggers the vulnerable code generation routine, causing the injected code to execute on the server. Refer to the Adobe Security Update Advisory (APSB26-142) for vendor-provided technical context.

Detection Methods for CVE-2026-84412

Indicators of Compromise

• Unexpected child processes spawned by the Adobe Campaign Classic service account
• Anomalous outbound network connections originating from Campaign Classic servers
• Unusual file creation or modification in the Campaign Classic installation directory
• Unexpected script execution or interpreter invocations from web-facing Campaign processes

Detection Strategies

• Monitor Adobe Campaign Classic application logs for malformed requests targeting code generation or template evaluation endpoints
• Deploy behavioral detection on Campaign Classic hosts to identify process lineage anomalies indicative of injected code execution
• Correlate HTTP request patterns with subsequent process creation events on the Campaign server
• Alert on Campaign service account executing shell commands, PowerShell, or scripting interpreters

Monitoring Recommendations

• Enable verbose audit logging on Adobe Campaign Classic and forward logs to a centralized SIEM for correlation
• Baseline normal outbound traffic from Campaign Classic servers and alert on deviations
• Track file integrity on Campaign Classic binaries, configuration files, and web-accessible directories
• Monitor authentication and privilege usage on the Campaign service account for lateral movement indicators

How to Mitigate CVE-2026-84412

Immediate Actions Required

• Apply the security update referenced in Adobe advisory APSB26-142 to all Adobe Campaign Classic instances without delay
• Inventory all Adobe Campaign Classic deployments, including versions 7.4.4:9400 and 7.4.4:9401, and verify patch status
• Restrict network access to Campaign Classic management and API endpoints using firewall rules or network segmentation
• Review Campaign Classic logs for indicators of prior exploitation attempts predating patch deployment

Patch Information

Adobe has released fixed versions of Campaign Classic addressing CVE-2026-84412. Consult the Adobe Security Update Advisory (APSB26-142) for the specific patched version numbers and download instructions applicable to your deployment.

Workarounds

• If immediate patching is not feasible, place Adobe Campaign Classic behind a web application firewall (WAF) with rules blocking suspicious payloads targeting code injection patterns
• Limit Campaign Classic exposure to trusted networks only through VPN or IP allowlisting
• Run the Campaign Classic service under a least-privilege account to reduce the blast radius of successful exploitation
• Disable or restrict access to any Campaign Classic features that accept externally supplied templates or scripts until the patch is applied

# Example: restrict inbound access to Adobe Campaign Classic on Linux via iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP