Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Adobe Campaign Classic can run unwanted code

CVE-2026-76197 · published 9 days ago
Summary

Adobe Campaign Classic lets an attacker send specially crafted data that causes the system to run any command it wants, without needing a user to click anything. This can lead to the attacker taking control of the server under the current user's permissions. Apply the latest Adobe update or patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe adobe campaign classic <= ACC v7: 7.4.4 build 9400
adobe campaign <= 7.3.2
7.4.1
7.4.2
7.4.3
7.4.4
cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*
Original advisory text
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution...
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
References
Severity
10.0 Critical
CVSS 3.1: 10.0 (MITRE)
Exploitation
EPSS 2%
Type
CWE-78OS Command Injection
Timeline
Published25 Aug 2026
Updated2 Sep 2026
First seen25 Aug 2026
Sources
CVE-2026-76197 · NVD
CVE-2026-76197 · MITRE
Monitor software like this
Free during beta