Advisory · CVE-2026-73369
Unauthenticated code injection in Adobe Campaign Classic (APSB26-142)
Adobe Campaign Classic is affected by an unauthenticated improper code-generation flaw that can lead to arbitrary code execution with scope changed. CVSS 10.0.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-73369
CWE-94 - Action timing
- Immediate
Explain it like I’m five
A marketing mailroom follows recipe cards to build campaigns. An attacker slips their own recipe card into the pile, and the mailroom cooks it without checking who wrote it.
- 01Target identified
An attacker reaches an internet-facing Adobe Campaign Classic instance with no credentials.
- 02Malicious input
They submit input that the application fails to control during code generation.
- 03Code executes
The injected code runs in the context of the current user with changed scope.
- 04Impact
Arbitrary code execution on the Campaign server, no user interaction required.
What happened
Adobe security bulletin APSB26-142 addresses multiple critical flaws in Adobe Campaign Classic. CVE-2026-73369 is an improper control of code generation (CWE-94) that an unauthenticated, remote attacker can exploit without user interaction, resulting in arbitrary code execution. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 10.0 (v3.1).
What to do
- Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later.
- Restrict network access to Campaign servers to trusted administrators while patching.
- Review application and system logs for unexpected process execution or web requests.
Management note
Unauthenticated remote code execution on enterprise marketing infrastructure is a worst-case server-side flaw. Campaign servers often hold customer contact data and mail credentials, so patching doubles as data-protection work.