CVE-2026-89276: Adobe Campaign Classic RCE Vulnerability

CVE-2026-89276 Overview

Adobe Campaign Classic (ACC) contains a code injection vulnerability [CWE-94] that allows a low-privileged attacker to execute arbitrary code in the context of the current user. The flaw stems from improper control of code generation within the application. Exploitation requires no user interaction and operates across a changed security scope, expanding the potential blast radius beyond the vulnerable component. Adobe published Security Bulletin APSB26-142 addressing this issue in Adobe Campaign Classic versions 7.4.4:9400 and 7.4.4:9401.

Critical Impact
A network-adjacent, low-privileged attacker can achieve arbitrary code execution with full impact on confidentiality, integrity, and availability across trust boundaries.

Affected Products

Adobe Campaign Classic version 7.4.4:9400
Adobe Campaign Classic version 7.4.4:9401
Adobe Campaign Classic instances deployed on Linux and Microsoft Windows hosts

Discovery Timeline

2026-09-22 - CVE-2026-89276 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-89276

Vulnerability Analysis

Adobe Campaign Classic is an enterprise cross-channel marketing platform used to orchestrate email, mobile, and direct-mail campaigns. The vulnerability resides in a code-generation path where untrusted input influences code that the application later evaluates. Because the scope is changed, code execution can affect resources beyond the vulnerable component's own security context. An attacker only needs low-privileged access to the application, which is common in multi-tenant marketing operations where operators, campaign managers, and integrators hold accounts. Successful exploitation yields arbitrary code execution as the current user, providing a foothold for lateral movement into subscriber data, marketing databases, and connected systems.

Root Cause

The underlying weakness is classified as Improper Control of Generation of Code [CWE-94]. The application constructs code dynamically without sufficiently validating or neutralizing attacker-controlled input before the code is interpreted or executed. This class of flaw typically appears in scripting subsystems, template engines, or workflow processors that translate operator input into executable logic. Adobe's advisory APSB26-142 confirms the defect but does not publish the specific vulnerable component.

Attack Vector

The attack is delivered over the network against an authenticated session. An attacker with any low-privileged Campaign Classic account can submit crafted input to the vulnerable interface. No victim interaction is required, which enables fully automated exploitation once credentials or an active session are obtained. The changed scope indicates that executed code can reach resources managed by a different security authority, such as backend services or the host operating system. Refer to the Adobe Security Bulletin APSB26-142 for vendor guidance.

Detection Methods for CVE-2026-89276

Indicators of Compromise

Unexpected child processes spawned by Adobe Campaign Classic server processes on Windows or Linux hosts.
Anomalous outbound network connections from Campaign servers to unfamiliar destinations following authenticated API or workflow activity.
New or modified files in Campaign application directories, particularly scripts, workflow definitions, or JavaScript templates written outside normal change windows.
Authentication events from low-privileged Campaign accounts followed immediately by administrative or code-execution activity.

Detection Strategies

Monitor Adobe Campaign application logs for workflow, JSSP, or SOAP API calls containing script fragments, eval-style constructs, or unusual payload sizes.
Correlate low-privilege Campaign session activity with process creation events on the underlying host to surface command execution launched by the application service account.
Alert on writes to Campaign configuration and script directories that occur outside sanctioned deployment pipelines.

Monitoring Recommendations

Ingest Campaign Classic web server, application, and workflow logs into a central analytics platform for continuous review.
Baseline expected process trees for the Campaign service account and alert on deviations such as shell interpreters, scripting hosts, or network utilities.
Track outbound egress from Campaign hosts and flag connections to non-approved IP ranges or newly registered domains.

How to Mitigate CVE-2026-89276

Immediate Actions Required

Apply the security updates published in Adobe Security Bulletin APSB26-142 to all Adobe Campaign Classic instances.
Inventory every Campaign Classic deployment, including staging and disaster-recovery environments, and confirm patch status across Windows and Linux hosts.
Review Campaign user accounts and remove or disable unused low-privileged operator accounts that could serve as an exploitation entry point.
Rotate credentials, API keys, and session tokens for any Campaign instance that cannot be immediately patched.

Patch Information

Adobe released fixed versions of Adobe Campaign Classic as documented in Security Bulletin APSB26-142. Administrators should follow Adobe's upgrade guidance for their deployment topology and validate the update against the release notes. Confirm the patched build number in the Campaign console after upgrade.

Workarounds

Restrict network access to the Campaign Classic console and API endpoints to trusted management networks or VPN segments.
Enforce multi-factor authentication on all Campaign operator accounts to reduce the risk of credential-based exploitation.
Run the Campaign service under a least-privileged operating system account to limit the impact of arbitrary code execution.
Increase logging verbosity for workflow execution and JavaScript activity until patching is complete.

bash

# Verify installed Adobe Campaign Classic build after applying APSB26-142
# Linux example
cat /usr/local/neolane/nl6/conf/build.properties | grep -i version

# Restrict console access at the network layer (Linux iptables example)
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP