High priorityDisclosed

Advisory · CVE-2026-75728

Incorrect authorization in Adobe Campaign Classic can lead to code execution

An incorrect authorization flaw in Adobe Campaign Classic lets an unauthenticated attacker reach arbitrary code execution without user interaction. CVSS 9.1.

Vendor
Adobe
Product
Adobe Campaign Classic
Identifier / CWE
CVE-2026-75728
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

A locked door has a sign that says staff only, but the lock was installed backwards. Anyone who turns the handle the wrong way walks straight into the control room.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Target identified

    An attacker reaches an internet-facing Adobe Campaign Classic instance with no credentials.

  2. 02Authorization gap

    An incorrectly enforced authorization check grants access it should deny.

  3. 03Code execution

    The attacker leverages the gap to execute arbitrary code in the context of the current user.

  4. 04Impact

    No user interaction is required; confidentiality and integrity of the server are at stake.

What happened

Adobe security bulletin APSB26-142 includes CVE-2026-75728, an incorrect authorization vulnerability (CWE-863) in Adobe Campaign Classic. An unauthenticated attacker can exploit it without user interaction to execute arbitrary code in the context of the current user. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 9.1 (v3.1).

What to do

  1. Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later.
  2. Restrict network access to Campaign servers while patching.
  3. Review logs for anomalous unauthenticated requests to privileged endpoints.

Management note

Authorization logic that fails open is an access-control design failure, not a typo. The fix ships in the same bulletin as the other Campaign flaws, so one upgrade covers the set.