Loading vulnerability…
OS Command Injection in Adobe Campaign Classic
CVE-2026-104353 is an OS command injection vulnerability in Adobe Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux. Improper neutralization of special elements in OS commands allows a low-privileged attacker to execute arbitrary code in the context of the current user. Exploitation is possible over a network with low attack complexity and requires no user interaction. The vulnerability has a CVSS v3.1 score of 9.9 with changed scope and high confidentiality, integrity, and availability impacts. The affected function and vulnerable input are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution with the privileges of the current user, potentially compromising the confidentiality, integrity, and availability of accessible data and services. The changed security scope indicates that the impact can extend beyond the vulnerable component's security authority; execution with administrative or system privileges is not established.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic to version 7.4.4 build 9403 or a later fixed release on Windows and Linux. Apply the update in accordance with Adobe security bulletin APSB26-162.
No public exploits tracked yet. Mallory keeps watching.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.