CVE-2026-76197: Adobe Campaign Classic OS command injection, CVSS 10.0

Adobe Campaign Classic disclosed CVE-2026-76197, a CVSS 10.0 OS command injection allowing unauthenticated remote code execution. Adobe published the advisory on 25 August; treat all versions as affected until mapped.

Overview

On 25 August 2026, Adobe disclosed a critical command-injection flaw in Adobe Campaign Classic (ACC): CVE-2026-76197. CVSS v3.1 base score 10.0. CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Unauthenticated remote attackers can inject and execute arbitrary OS commands against the ACC backend with no user interaction. Original description marks Scope as Changed: impact extends beyond the ACC component to the underlying host.

Adobe has not listed affected versions or a patched release. Third-party labs including Defensics and Penligent recommend shrinking the attack surface on all ACC versions until official version mapping lands, and adding this CVE to the IR checklist.

Technical details

Root cause: ACC concatenates a user-controlled input field (likely a request parameter or admin-console form) into an underlying shell call without adequate escaping or filtering of OS-shell metacharacters. Attackers embed payloads such as:

field=value; id; cat /etc/passwd > /tmp/p
field=value | whoami
field=value$(id)
field=value`id`

Because Scope is Changed, a successful attacker can read/write the ACC business database, exfiltrate PII and campaign config, plant a persistent backdoor on the host OS, and move laterally to other services co-hosted with ACC. CVSS 10.0 means Attack Complexity, Privileges Required, and User Interaction are all attacker-optimal:

• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Confidentiality / Integrity / Availability: all High

Impact assessment

Adobe Campaign Classic is widely used in retail, finance, and telecom for large-scale marketing automation, customer-journey orchestration, and transactional mail. Compromise of a single ACC instance typically means customer PII, marketing-budget strategy, and partner contracts leak together. Combined Scope Changed and no-auth, treat this as a no-precondition critical supply-chain event. Assume every unpatched ACC instance exposed to the internet is already at risk.

No public PoC at this time. CWE-78 is trivial for experienced attackers to weaponize; underground exploit expected shortly. Immediately add emergency WAF rules for shell metacharacters (e.g. Baidu Cloud WAF) and complete version inventory plus patch prep within 24 hours.

Remediation

• Official patch: Adobe has not published a fixed version. Track `https://helpx.adobe.com/security.html` and `https://www.adobe.com/products/campaign.html` security updates; upgrade to the next official patched release
• Network mitigation: pull ACC admin console and APIs off the public internet behind VPN or ZTNA. Strict ACL on any internet-facing endpoints. Professional WAF (Baidu Cloud WAF, ModSecurity + OWASP CRS) to block `; | & $ \`` metacharacter payloads
• App-layer hardening: at the reverse proxy, reject empty User-Agent, Referer mismatch vs target domain, or missing CSRF token. Enable request-body size limits and rate limits on all ACC web interfaces
• Temporary mitigation (no patch yet): if business allows, restrict ACC admin to trusted IP ranges. Least-privilege the accounts that can reach command-injection paths; deny write to other host directories
• Detection: on ACC hosts, regex-alert nginx/apache access logs for `(;|\||\$\(|`)` in request bodies. Use auditd / osquery to watch ACC user processes spawning `curl`, `wget`, `bash`, `sh`
• Threat intel: subscribe to Adobe PSIRT and CISA KEV. On KEV listing, execute to CISA federal response timelines
• IR: keep ACC DB and config backups offsite cold. Prepare an IR runbook with a process-whitelist hard-kill script to cut ACC from upstream/downstream marketing systems if compromise is suspected

Sources

• The Hacker Wire: CVE-2026-76197 Adobe Campaign Classic RCE
• Adobe Product Security Incident Response Team