CVE-2026-89275: Adobe Campaign Classic RCE Vulnerability

CVE-2026-89275 Overview

Adobe Campaign Classic (ACC) contains a code injection vulnerability [CWE-94] that allows arbitrary code execution in the context of the current user. The flaw stems from improper control of code generation within the application. An attacker can exploit this issue over the network without authentication or user interaction. The vulnerability produces a scope change, meaning exploitation can affect components beyond the initially vulnerable one. Adobe published advisory APSB26-142 to address the issue in affected Campaign Classic builds.

Critical Impact

Unauthenticated network attackers can execute arbitrary code on Adobe Campaign Classic instances without user interaction, with impact extending beyond the vulnerable component due to scope change.

Affected Products

• Adobe Campaign Classic (versions matching cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*)
• Adobe Campaign Classic 7.4.4:9400
• Adobe Campaign Classic 7.4.4:9401 on Linux and Microsoft Windows platforms

Discovery Timeline

• 2026-09-22 - CVE-2026-89275 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-89275

Vulnerability Analysis

The vulnerability is categorized under CWE-94: Improper Control of Generation of Code. Adobe Campaign Classic constructs or evaluates code from input that is not properly neutralized. An attacker who supplies crafted input to a vulnerable code-generation path causes the application to execute attacker-controlled instructions. Because exploitation requires no authentication and no user interaction, any reachable Adobe Campaign Classic instance is exposed to network-based attacks. The scope change indicates that successful exploitation can impact resources outside the security scope of the vulnerable Campaign component.

The EPSS model estimates a 1.248% probability of exploitation in the next 30 days as of 2026-09-24.

Root Cause

The root cause is the lack of proper neutralization of directives that control code generation. Adobe Campaign Classic evaluates expressions or templates derived from untrusted input without enforcing safe parsing boundaries. When attacker input reaches these evaluation paths, the generated code executes with the privileges of the current user account running the Campaign process.

Attack Vector

Exploitation occurs remotely over the network against an exposed Adobe Campaign Classic endpoint. The attacker submits a specially crafted request containing an injection payload targeting the vulnerable code-generation routine. No credentials are required and no user action is needed. After the payload is processed, arbitrary code executes on the host in the security context of the Campaign application user, and impact can extend into adjacent components due to the scope change.

Adobe has not published exploitation specifics. Refer to the Adobe Security Bulletin APSB26-142 for vendor guidance.

Detection Methods for CVE-2026-89275

Indicators of Compromise

• Unexpected child processes spawned by the Adobe Campaign Classic service account, including shells such as cmd.exe, powershell.exe, /bin/sh, or /bin/bash.
• Anomalous outbound network connections from Campaign Classic hosts to previously unseen destinations.
• Modifications to Campaign template files, scheduled workflows, or JavaScript activity definitions that do not correspond to authorized change requests.
• New or modified files in the Campaign installation directory, especially executable content or scripts not present in the vendor package.

Detection Strategies

• Alert on process-lineage anomalies where the Campaign application process spawns interpreters or command shells.
• Inspect HTTP requests to Campaign endpoints for encoded script fragments, template delimiters, or expression syntax that could reach code-generation routines.
• Correlate authentication-free requests with subsequent process creation events on Campaign hosts.
• Baseline normal outbound traffic from Campaign servers and flag deviations toward external IPs or non-standard ports.

Monitoring Recommendations

• Forward Adobe Campaign Classic application logs, web server logs, and host process telemetry to a centralized SIEM for correlation.
• Monitor filesystem changes under the Campaign installation path and configuration directories for unauthorized writes.
• Track service account activity for behaviors outside the documented Campaign workload profile.

How to Mitigate CVE-2026-89275

Immediate Actions Required

• Inventory all Adobe Campaign Classic deployments, including versions 7.4.4:9400 and 7.4.4:9401 on Linux and Windows hosts.
• Apply the fixes referenced in Adobe Security Bulletin APSB26-142 as the primary remediation.
• Restrict network exposure of Campaign Classic management and API endpoints to trusted administrative networks only.
• Review Campaign service account privileges and reduce them to the minimum required for operation.

Patch Information

Adobe released the fix in security bulletin APSB26-142. Administrators should consult the Adobe advisory to identify the fixed builds applicable to their deployment and follow Adobe's documented upgrade procedure. Validate the patch in a staging environment before production rollout to confirm workflow compatibility.

Workarounds

• Place Adobe Campaign Classic endpoints behind a reverse proxy or web application firewall that filters requests containing template or expression syntax targeting code-generation routines.
• Segment Campaign Classic servers from the broader network to limit lateral movement if the scope-changing exploit succeeds.
• Disable or restrict external access to any Campaign features that accept administrative script or template input from untrusted users.

# Example: restrict inbound access to Adobe Campaign Classic to a trusted admin subnet
# Linux (iptables)
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP

# Windows (PowerShell)
New-NetFirewallRule -DisplayName "ACC-AdminOnly" -Direction Inbound `
  -Protocol TCP -LocalPort 8080 -RemoteAddress 10.10.20.0/24 -Action Allow
New-NetFirewallRule -DisplayName "ACC-BlockOther" -Direction Inbound `
  -Protocol TCP -LocalPort 8080 -Action Block