Adobe Campaign Classic Incorrect Authorization Remote Code Execution

Successful exploitation provides arbitrary code execution in the Adobe Campaign Classic application’s current-user security context. The CVSS v3.1 vector indicates high confidentiality, integrity, and availability impact with changed scope, allowing compromise to affect resources beyond the vulnerable component according to the permissions and network connectivity of the Campaign Classic service. A compromised instance may expose customer and campaign data, enable modification of campaign operations, disrupt service, and provide a foothold for access to connected enterprise systems.

If patching cannot be completed immediately, restrict Campaign Classic application access to trusted networks and administrative users, eliminate unnecessary internet exposure, and apply segmentation or allowlisting controls. Monitor application, authentication, web, and host telemetry for anomalous authorization behavior and unexpected process execution. Review connected systems and rotate credentials held by Campaign Classic if compromise is suspected.

Upgrade Adobe Campaign Classic v7 installations to 7.4.3 build 9398 or a later Adobe-recommended release. Prioritize customer-managed fully on-premises deployments and on-premises components of hybrid deployments. Adobe-hosted instances were remediated by the provider. Investigate for potential historical compromise after patching, because applying the update does not remove attacker persistence or remediate actions performed before installation.