Adobe Campaign Classic Has Three CVSS 10 Paths to Code Execution
Adobe has fixed three critical Adobe Campaign Classic vulnerabilities that can let an unauthenticated network attacker execute code without user interaction. All three carry a CVSS 3.1 score of 10.0. On-premises and hybrid customers should update Adobe Campaign Classic v7 to 7.4.4 build 9401.
The vulnerable platform is not an ordinary public website. Adobe Campaign Classic coordinates marketing campaigns, customer data, message delivery and integrations with other enterprise systems. A compromise can therefore expose both a privileged server and the trust relationships around it.
Adobe disclosed one server-side request forgery flaw, CVE-2026-76193, and two OS command-injection flaws, CVE-2026-76195 and CVE-2026-76197. Each can lead to arbitrary code execution in the context of the Campaign Classic process.
Three separate routes to the same outcome
| CVE | Technical impact | Prerequisites | Affected and fixed versions | Exploitation and PoC status |
|---|---|---|---|---|
| CVE-2026-76193 CVSS 3.1: 10.0 | Server-side request forgery that can cross the application boundary and result in arbitrary code execution. | Network reachable, low complexity, no privileges and no user interaction. | Adobe Campaign Classic v7 7.4.4 build 9400 and earlier. Fixed in build 9401. | Adobe and NCSC-NL report no known active exploitation. BlackTree found no credible public PoC, exploit module or detection template at the time of writing. |
| CVE-2026-76195 CVSS 3.1: 10.0 | Improper neutralisation of special elements in an OS command, allowing arbitrary command execution. | Network reachable, low complexity, no privileges and no user interaction. | Adobe Campaign Classic v7 7.4.4 build 9400 and earlier. Fixed in build 9401. | No confirmed exploitation and no credible public PoC found at publication time. |
| CVE-2026-76197 CVSS 3.1: 10.0 | A second OS command-injection path that can execute arbitrary code with the rights of the Campaign Classic process. | Network reachable, low complexity, no privileges and no user interaction. | Adobe Campaign Classic v7 7.4.4 build 9400 and earlier. Fixed in build 9401. | No confirmed exploitation and no credible public PoC found at publication time. |
The bulletin does not describe a separate workaround. The remediation is to install the fixed release. Adobe assigned the update Priority 1, its highest deployment priority, and advises administrators to install it within 72 hours.
The deployment model determines who must act
The update applies to fully on-premises Campaign Classic deployments and to the on-premises components of hybrid deployments. Adobe says it has already remediated Adobe-hosted instances. A hybrid customer should not assume that the hosted portion of the service also fixes software running inside its own environment.
That distinction matters because Campaign Classic deployments commonly integrate with databases, message-transfer systems, identity services, web applications and internal data sources. Code execution on the Campaign Classic host can become an entry point to systems that are not directly exposed to the internet.
Why the SSRF flaw is rated like code execution
Server-side request forgery is sometimes treated as an information-disclosure or network-scanning problem. CVE-2026-76193 is more serious. Adobe’s CVSS vector records a changed scope and high confidentiality, integrity and availability impact because the forged request can be turned into arbitrary code execution.
The Campaign Classic server makes the request from a trusted position. That can expose internal services, cloud metadata endpoints or administrative interfaces that reject connections from the public internet but accept traffic from the application network. The vulnerable server becomes a proxy through the perimeter.
The command-injection flaws remove another boundary
CVE-2026-76195 and CVE-2026-76197 reach the operating system more directly. Improperly neutralised input can be incorporated into commands executed by the Campaign Classic process. Because neither vulnerability requires authentication or user interaction, an exposed vulnerable service can be attacked without stealing an account first.
The resulting privileges depend on how the service is configured. Administrators should nevertheless treat the host as potentially fully compromised after suspected exploitation. Even a service account with constrained local rights may hold database credentials, integration secrets, API tokens or access to campaign data.
What defenders should do now
- Identify the deployment model. Confirm whether Campaign Classic is fully hosted, on-premises or hybrid. Inventory every on-premises component rather than checking only the visible application endpoint.
- Update to build 9401. Campaign Classic v7 7.4.4 build 9400 and earlier is affected on Windows and Linux. Verify the installed build after the maintenance window.
- Reduce network exposure. Restrict Campaign Classic interfaces to the users, management networks and integrations that require them. An internet-reachable instance gives an unauthenticated attacker a direct path to the vulnerable service.
- Constrain outbound access. Egress filtering can reduce the destinations reachable through an SSRF condition. Block access from the application host to cloud metadata endpoints and unrelated internal management services.
- Review host and application telemetry. Look for unexpected child processes, shell or command-interpreter activity, unusual outbound requests, newly created files, modified scheduled tasks and access to credentials stored by the application.
- Prepare for weaponisation. No public exploit was identified at publication time. A credible reproduction, scanner or exploit module would materially shorten the time available to patch externally reachable systems.
The larger security lesson
Marketing infrastructure often sits outside the systems that receive the most security attention, yet it can process large customer datasets and connect to multiple business platforms. The three Campaign Classic vulnerabilities show why exposure, privileges and integration reach matter as much as the product label.
There is no evidence that attackers are exploiting these flaws today. That is a reason to patch before the evidence changes, not a reason to wait. Three unauthenticated, network-reachable paths to code execution in the same enterprise platform create an unusually clear priority.
Sources and publication details
- Adobe security bulletin APSB26-134, published 25 August 2026. Adobe provides a date but no publication time.
- NCSC-NL: Critical vulnerabilities in Adobe Campaign Classic with risk of system compromise, published 27 August 2026. The advisory record was published at 09:42 CEST.
- NVD record for the SSRF vulnerability, published 25 August 2026 at 18:18 UTC.
- HKCERT Adobe monthly security update, updated 27 August 2026. The page provides a date but no update time.
