Advisory · CVE-2026-104353
OS command injection in Adobe Campaign Classic lets a low-privileged attacker execute arbitrary code
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an OS command injection flaw that a low-privileged attacker can use to execute arbitrary code in the context of the current user, with scope changed and no user interaction. CVSS 3.1 9.9.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-104353
CWE-78 - Action timing
- Immediate
Explain it like I’m five
The platform builds operating system commands out of user input without scrubbing the special characters. A low-level account can append its own command and have the server run it.
- 01Low-privileged sign-in
The attacker authenticates with a low-privileged Campaign Classic account.
- 02Command input crafted
The attacker supplies input containing OS command separators or special elements.
- 03Command string assembled
The application builds an operating system command that includes the unneutralized input.
- 04Attacker command runs
The operating system executes the injected command in the context of the current user.
What happened
Adobe published CVE-2026-104353 in NVD on October 27, 2026, rating it critical at CVSS 3.1 9.9: Adobe Campaign Classic is affected by an OS command injection vulnerability (CWE-78) that could result in arbitrary code execution in the context of the current user. A low-privileged attacker can exploit it without user interaction, and the scope is changed.
Adobe’s bulletin APSB26-162 covers Campaign Classic 7.4.4 build 9402 and earlier; the record lists build 9403 as the fixed, unaffected build.
What to do
- Inventory Adobe Campaign Classic instances, including application servers, execution instances, and any internet-facing web application servers, and note the build of each.
- Apply the APSB26-162 update to build 9403 or later on every instance running 7.4.4 build 9402 or earlier.
- Until every instance is updated, restrict network access to Campaign Classic consoles and application endpoints to trusted administrators and integrated systems only.
- Review Campaign Classic, web server, and database logs for unexpected code execution, new operators, changed workflows, and unusual SQL activity, especially from low-privileged accounts.
- Rotate operator passwords, database credentials, and integration secrets for any instance where suspicious activity cannot be excluded.
- Verify the deployed build after updating, including standby, staging, and disaster-recovery instances.
Management note
Campaign Classic sits on customer data and can act on it at scale, and this bulletin is a cluster of code execution and SQL injection flaws reachable with little or no privilege. Treat the bulletin as one urgent change: patch the whole estate, then work the logs, because any single one of these flaws is enough to take the platform.