Loading vulnerability…
Unauthenticated OS Command Injection in Adobe Campaign Classic
CVE-2026-76195 is an OS command injection vulnerability in Adobe Campaign Classic v7 version 7.4.4 build 9400 and earlier. Insufficient neutralization of attacker-controlled input incorporated into operating-system commands allows an unauthenticated remote attacker to submit specially crafted requests and execute arbitrary commands or code in the context of the current user or Campaign Classic service account. Affected environments include Windows and Linux on-premises installations and on-premises components of hybrid deployments. Exploitation requires no user interaction.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary operating-system command and code execution with the privileges of the Campaign Classic process, compromising the confidentiality, integrity, and availability of the affected instance. Depending on the privileges of the executing account, exploitation could result in complete compromise of the Campaign Classic host.
If you can’t patch tonight, do this now.
Until the update is deployed, restrict access to Campaign Classic interfaces to trusted users and networks, minimize application and service-account privileges, and segment the host from sensitive internal services. Monitor application and server logs for unauthorized access, unexpected processes spawned by Campaign Classic services, suspicious command execution, and unusual outbound connections. These measures reduce exposure but do not replace patching.
Patch, then assume compromise.
Upgrade affected Adobe Campaign Classic v7 installations to version 7.4.4 build 9401 or later. Verify that updates are applied across all affected Windows and Linux on-premises installations, including on-premises components of hybrid deployments. Adobe-hosted instances have already been remediated.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.