Loading vulnerability…
Unauthenticated OS Command Injection in Adobe Campaign Classic
CVE-2026-76197 is an operating-system command injection vulnerability in Adobe Campaign Classic v7 version 7.4.4 build 9400 and earlier. Improper neutralization of externally influenced input incorporated into operating-system commands allows an unauthenticated remote attacker to execute arbitrary commands or code in the context of the current user or Campaign Classic service process. Exploitation does not require user interaction. Affected environments include Windows and Linux on-premises installations and on-premises components of hybrid deployments.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary operating-system command execution with the privileges of the user running the affected Campaign Classic process. This can compromise the confidentiality, integrity, and availability of the affected instance and potentially result in complete host compromise, depending on the process privileges.
If you can’t patch tonight, do this now.
Until the update can be deployed, restrict access to Campaign Classic interfaces to trusted users and networks, minimize application and service-account privileges, and segment the server from sensitive internal systems. Monitor application and server logs for unauthorized access, abnormal process execution, unexpected outbound connections, and unanticipated configuration changes. These measures reduce exposure but do not replace patching.
Patch, then assume compromise.
Upgrade affected Adobe Campaign Classic v7 installations to version 7.4.4 build 9401 or later, following Adobe security bulletin APSB26-134. Verify that updates cover all affected Windows and Linux on-premises instances, including local components of hybrid deployments. Adobe-hosted instances have already been remediated.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.