Adobe Campaign Classic

product · product:adobe-campaign-classic single-source

Coverage

first 2026-08-02 → last 2026-10-02

Latest activity

2026-10-02

Adobe's 22 September revision grew one Campaign Classic CVE into eighteen, ten unauthenticated; build 9402…

Peak priority

high

3 high · 1 notable

Targets

public-sector

sectors: public-sector, technology, finance · regions: europe

Sources cited

4 hosts

Action items (5)

Do-now tasks recorded on the entries about Adobe Campaign Classic, newest first. Check the date before acting on an older one.

Update every on-premise Adobe Campaign Classic v7 server, and the on-premise components of any hybrid deployment, to build 9402; build 9401 fixes only APSB26-134's three flaws, and an Adobe-hosted instance that still reports 9401 is not evidence of exposure.
2026-10-02CVE-2026-82004 +12
Patch internet-facing ColdFusion 2025/2023 instances to 2025.0.12 / 2023.0.23 now; CVE-2026-48362 is an unauthenticated OS command injection at CVSS 10.0, the class of flaw that gets weaponised within days of a patch diff being published, and Adobe reports no exploitation yet, which is the window to close before one exists.
2026-08-28CVE-2026-48362 +5
For any on-premise or hybrid Adobe Campaign Classic ACC v7 deployment, upgrade to 7.4.4 build 9400 now, two of the three fixed flaws (CVE-2026-71398, CVE-2026-27302) are unauthenticated CVSS 10.0 code-execution paths; Adobe-hosted instances are already remediated and need no action.
2026-08-28CVE-2026-48362 +5
Upgrade on-premise Adobe Campaign Classic to ACC v7 7.4.3 build 9399, build 9398, applied as the fix for APSB26-114 on 2026-07-29, is inside the affected range for all seven of these flaws.
2026-08-07CVE-2026-48331 +6
Establish whether your Adobe Campaign Classic is Adobe-hosted or self-hosted before scheduling anything; Adobe states hosted instances are already remediated, so the work is confined to fully on-premise deployments and the on-premise components of hybrid ones; upgrade those to ACC v7 7.4.3 build 9398.
2026-08-02CVE-2026-48449 +1

Defender insights

What each entry about Adobe Campaign Classic tells a defender to do, newest first.

2026-10-02NOTABLEAdobe's 22 September revision grew one Campaign Classic CVE into eighteen, ten unauthenticated; build 9402 closes them

Exposure · detection

2026-08-02HIGHAdobe ships a priority-1 fix for a CVSS 10.0 unauthenticated code-execution flaw in Campaign Classic; only self-hosted and hybrid installs need action

Triage

Story timeline

2026-10-02Adobe Campaign Classic: eight unauthenticated CVSS 10.0 flaws in APSB26-142 and three more in APSB26-134, with build 9402 as the fix
trending-vulnerabilitiesAdobe's 22 September revision grew one Campaign Classic CVE into eighteen, ten unauthenticated; build 9402 closes them
2026-08-28Adobe August 2026 Patch Day: ColdFusion ships a CVSS 10.0 unauthenticated OS command injection, and Campaign Classic ships two more unauthenticated CVSS 10.0 flaws in the same release
trending-vulnerabilitiesAdobe's August bulletins carry three separate unauthenticated, maximum-severity code-execution flaws across ColdFusion and Campaign Classic
2026-08-07Adobe Campaign Classic APSB26-120, three more unauthenticated CVSS 10.0 code-execution flaws, and last week's build 9398 is the version they affect
trending-vulnerabilitiesAdobe ships a second Campaign Classic emergency fix in five days; build 9398 was the patch, and build 9398 is vulnerable
2026-08-02CVE-2026-48449, Adobe Campaign Classic: an authorization flaw gives unauthenticated arbitrary code execution (CVSS 10.0), on-premise and hybrid deployments only
trending-vulnerabilitiesAdobe ships a priority-1 fix for a CVSS 10.0 unauthenticated code-execution flaw in Campaign Classic; only self-hosted and hybrid installs need action

ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 4 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

Initial AccessExploit Public-Facing Application
ExecutionCommand and Scripting Interpreter

Initial Access TA0001

T1190Exploit Public-Facing Application×4

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-02/adobe-campaign-classic-apsb26-142-134-unauth-cvss10 · 2026-08-28/adobe-august-2026-coldfusion-campaign-classic-cvss10 · 2026-08-07/adobe-campaign-classic-apsb26-120-second-wave-unauth-rce · 2026-08-02/adobe-campaign-classic-apsb26-114-cvss10-unauth-rce · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-08-07/adobe-campaign-classic-apsb26-120-second-wave-unauth-rce · ATT&CK page ↗

Entries about Adobe Campaign Classic (4)

2026-10-02 · view entry permalink →

NOTABLECVE-2026-82004 +12NATOA2

Adobe Campaign Classic: eight unauthenticated CVSS 10.0 flaws in APSB26-142 and three more in APSB26-134, with build 9402 as the fix

Adobe's Priority 1 bulletin APSB26-142 covers Adobe Campaign Classic v7 7.4.4 build 9401 and earlier on Windows and Linux and names build 9402 as the fix; it was published on 2026-09-08 with one CVE and revised on 2026-09-22 to add seventeen more, for eighteen, all rated Critical (Adobe PSIRT, 2026-09-22). Ten of the eighteen need no privileges: eight are CVSS 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (CVE-2026-82004, an OS command injection; six code-injection flaws, CVE-2026-73369, -84412, -89275, -75699, -75703 and -75721; and CVE-2026-75723, an incorrect-authorization flaw), plus CVE-2026-83660 (SSRF, 9.9) and CVE-2026-75728 (incorrect authorization, 9.1) (Adobe PSIRT, 2026-09-22). The remaining eight require low or high privileges. The earlier bulletin APSB26-134 (Priority 1, 2026-08-25) fixed three more unauthenticated CVSS 10.0 flaws in build 9401, CVE-2026-76197 and CVE-2026-76195 (OS command injection) and CVE-2026-76193 (SSRF) (Adobe PSIRT, 2026-08-25).

Adobe states it is not aware of exploitation of any issue in APSB26-142, and none of these CVEs is in CISA's KEV catalog as of the 2026-10-01 version (Adobe PSIRT, 2026-09-22; CISA KEV, 2026-10-01). The bulletin applies to fully on-premise deployments and the on-premise components of hybrid deployments; Adobe-hosted instances are already remediated, and because the hosted fixes did not increment the customer-visible build number, some hosted instances still report build 9401 (Adobe PSIRT, 2026-09-22). Adobe's table names build 9402 for all eighteen, so estates that moved to it for the single CVE visible on 2026-09-08 already hold every fix; estates that stopped at build 9401 or earlier carry the ten unauthenticated flaws.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Adobe-hosted instances have already been remediated and require no customer action.

some Adobe-hosted instances may continue to report build 9401 even though the applicable security fixes have already been deployed

Adobe PSIRT (APSB26-142) 2026-09-22

Builds on: Adobe ships a priority-1 fix for a CVSS 10.0 unauthenticated code-execution flaw in Campaign… · Adobe ships a second Campaign Classic emergency fix in five days; build 9398 was the patch, and… · Adobe's August bulletins carry three separate unauthenticated, maximum-severity code-execution…

vulnerability02 Oct 05:00Zsingle-sourceOpen finding →

Sources: Adobe PSIRT (APSB26-142) · Adobe PSIRT (APSB26-134) · CISA Known Exploited Vulnerabilities catalog

2026-08-28 · view entry permalink →

HIGHCVE-2026-48362 +5NATOA2

Adobe August 2026 Patch Day: ColdFusion ships a CVSS 10.0 unauthenticated OS command injection, and Campaign Classic ships two more unauthenticated CVSS 10.0 flaws in the same release

Adobe's 2026-08-11 Security Patch Day carries two bulletins whose headline flaws are unauthenticated, no-interaction paths to arbitrary code execution at CVSS 10.0. APSB26-90 fixes 16 CVEs in ColdFusion 2025 (≤2025.0.11) and 2023 (≤2023.0.22), led by CVE-2026-48362 (CWE-78, OS command injection, CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) (unauthenticated arbitrary code execution) and CVE-2026-48273 (CWE-95, eval injection, 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which needs low-privileged access rather than none (Adobe, APSB26-90, 2026-08-11). The remaining fourteen span incorrect-authorization application denial-of-service (CVE-2026-71384, 9.6), cross-site scripting escalating to code execution (CVE-2026-71386, 8.8), privilege escalation via input validation (CVE-2026-21273, 8.7), further authorization and hard-coded-key defects down to CVSS 4.9, and a heap-based buffer overflow (CVE-2026-48440, 8.1). Adobe states it is "not aware of any exploits in the wild for any of the issues addressed in this update," and separately recommends keeping the underlying JDK/JRE current and reviewing its serialFilter guidance for insecure deserialization (Adobe, APSB26-90, 2026-08-11).

APSB26-123 covers Adobe Campaign Classic, explicitly scoped to on-premise deployments and the on-premise leg of hybrid deployments, since "Adobe-hosted instances have already been remediated and require no customer action" (Adobe, APSB26-123, 2026-08-11). Two of its three fixed CVEs are unauthenticated CVSS 10.0 incorrect-authorization flaws reaching arbitrary code execution (CVE-2026-71398 and CVE-2026-27302, the same vector under two identifiers) and the third, CVE-2026-48381 (CWE-89, SQL injection, 9.0, AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), is unauthenticated with high attack complexity. All three are fixed in ACC v7 7.4.4 build 9400 for both Windows and Linux; the earlier 7.4.3 build 9399 and prior are affected. No exploitation is reported for either bulletin, and neither Adobe advisory names a researcher, which is consistent with an internally-found batch.

Detection, in vendor-neutral terms: ColdFusion's command-injection path and Campaign Classic's authorization flaws both reach the underlying host or database with no prior authentication, so the durable telemetry is process-lineage and query-shape anomalies rather than an authentication event, a ColdFusion application-server process spawning an OS shell or interpreter with no corresponding administrative session, and Campaign Classic database queries or file operations issued outside the product's own scheduled and interactive-session patterns. Because no public proof-of-concept or exploitation report exists yet for either bulletin, the defensible position is to treat the patch window itself as the exposure window and close it before a diff-derived exploit appears, rather than waiting for confirmed activity.

Adobe has released a security update for ColdFusion versions 2025 and 2023. This update resolves critical and important vulnerabilities that could result in arbitrary code execution, privilege escalation, security feature bypass, application denial-of-service, and memory exposure.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Adobe (APSB26-90) 2026-08-11

This security bulletin applies only to fully on-premise deployments of Adobe Campaign Classic and to the on-premise components of hybrid deployments. Adobe-hosted instances have already been remediated and require no customer action.

Adobe (APSB26-123) 2026-08-11

vulnerability28 Aug 05:15Zsingle-sourceOpen finding →

Sources: Adobe (APSB26-90) · Adobe (APSB26-123)

2026-08-07 · view entry permalink →

HIGHCVE-2026-48331 +6NATOA2

Adobe Campaign Classic APSB26-120, three more unauthenticated CVSS 10.0 code-execution flaws, and last week's build 9398 is the version they affect

Five days after Adobe fixed two critical unauthenticated flaws in Campaign Classic with build 9398, APSB26-114, dated 2026-07-29, also a Priority 1 update (Adobe PSIRT, 2026-07-29), it published a second bulletin whose affected range includes build 9398. APSB26-120, dated 2026-08-03, covers seven vulnerabilities in the on-premise campaign-management platform and records the affected versions as "ACC v7: 7.4.3 build 9398 and earlier", fixed in ACC v7 7.4.3 build 9399, at Adobe's highest priority rating of 1 (Adobe PSIRT, 2026-08-03). Any operator who treated last week's build as the end state (which is what the previous advisory called for) is still carrying every flaw below.

Three of the seven need no authentication and no user interaction, each scored CVSS 10.0 with changed scope (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and each independently sufficient for arbitrary code execution per Adobe's own impact column: CVE-2026-48331, a server-side request forgery (CWE-918); CVE-2026-48323, improper neutralization of special elements used in a template engine (CWE-1336); and CVE-2026-48330, a SQL injection (CWE-89). Four more carry a precondition: CVE-2026-48326 (CVSS 9.9) is a second SQL injection reaching code execution but requiring low privileges; CVE-2026-48333 (CVSS 9.8) is an incorrect-authorization flaw (CWE-863) giving unauthenticated privilege escalation; CVE-2026-48317 (CVSS 9.6) is an eval injection (CWE-95) needing low privileges; and CVE-2026-48399 (CVSS 7.5) is a violation of secure design principles (CWE-657) yielding a security-feature bypass. Adobe rates all seven Critical and states that it "is not aware of any exploits in the wild for any of the issues addressed in these updates" (Adobe PSIRT, 2026-08-03). NCSC-NL relayed the bulletin on 2026-08-06 and is explicit that it is not an update of its own earlier Campaign Classic advisory but a separate set of newly found vulnerabilities (NCSC-NL, 2026-08-06).

Exposure is a question of who runs their own instance: the bulletin "applies only to fully on-premise deployments of Adobe Campaign Classic and to the on-premise components of hybrid deployments", with Adobe-hosted instances already remediated and needing no customer action (Adobe PSIRT, 2026-08-03). This is the third distinct wave of critical unauthenticated code-execution-class disclosures against this product line since late June (Adobe PSIRT, 2026-07-29), each at Adobe's top priority, which is itself the planning signal, a platform producing pre-auth CVSS-10.0 flaws on a roughly weekly cadence is one to move off the public internet rather than one to keep patching in place. Detection concepts, telemetry class first: with no public proof-of-concept and no reported exploitation, version state is the only reliable check, so inventory on-premise ACC instances against build 9399 rather than waiting for exploitation telemetry; where the application server's outbound traffic is logged, unexpected egress initiated by the ACC process is the observable class the SSRF would produce, and unexpected child processes spawned by the web or template-rendering service is what the template-injection and eval-injection paths would produce. Both are behavioural classes derived from the flaw types Adobe names, not from any reported intrusion, no cited source describes an actual attack against these CVEs, so nothing here should be read as a hunt for known activity. One bookkeeping change worth noting for anyone who tracks Adobe CVE counts: the bulletin states that effective 2026-08-11, Adobe may assign a single CVE identifier to internally discovered vulnerabilities sharing a severity rating and CWE category when a release includes systemic fixes, so future counts will understate flaw counts relative to this one.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

This security bulletin applies only to fully on-premise deployments of Adobe Campaign Classic and to the on-premise components of hybrid deployments.

Adobe PSIRT 2026-08-03

vulnerability07 Aug 04:41Zmulti-sourceOpen finding →

Sources: Adobe PSIRT · NCSC-NL · Adobe PSIRT (APSB26-114)

Earlier coverage (1)

2026-08-02HIGHNATOA2CVE-2026-48449, Adobe Campaign Classic: an authorization flaw gives unauthenticated arbitrary code execution (CVSS 10.0), on-premise and hybrid deployments onlyAdobe published APSB26-114 on 2026-07-29 for two critical flaws in Adobe Campaign Classic, the campaign-management and customer-data platform, fixed in ACC v7 build 9398. CVE-2026-48449 (CVSS 3.1 10.0, CWE-863 Incorrect Authorization) allows arbitrary code execution with no authentication, no user interaction and a changed scope; CVE-2026-48448 (CVSS 8.6, CWE-89) is an unauthenticated SQL injection giving arbitrary file-system read. Adobe assigns the update its highest priority rating and states it is not aware of exploitation. The bulletin applies only to fully on-premise deployments and to the on-premise components of hybrid deployments; Adobe-hosted instances were already remediated and need no customer action, which makes this an exposure question about who runs their own ACC rather than a platform-wide event.

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

Vulns4

Source distribution

helpx.adobe.com5 (62%)
adobe.com1 (12%)
advisories.ncsc.nl1 (12%)
cisa.gov1 (12%)

All cited sources (8)