Advisory · CVE-2026-75728
Incorrect authorization in Adobe Campaign Classic can lead to code execution
An incorrect authorization flaw in Adobe Campaign Classic lets an unauthenticated attacker reach arbitrary code execution without user interaction. CVSS 9.1.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-75728
CWE-863 - Action timing
- Immediate
Explain it like I’m five
A locked door has a sign that says staff only, but the lock was installed backwards. Anyone who turns the handle the wrong way walks straight into the control room.
- 01Target identified
An attacker reaches an internet-facing Adobe Campaign Classic instance with no credentials.
- 02Authorization gap
An incorrectly enforced authorization check grants access it should deny.
- 03Code execution
The attacker leverages the gap to execute arbitrary code in the context of the current user.
- 04Impact
No user interaction is required; confidentiality and integrity of the server are at stake.
What happened
Adobe security bulletin APSB26-142 includes CVE-2026-75728, an incorrect authorization vulnerability (CWE-863) in Adobe Campaign Classic. An unauthenticated attacker can exploit it without user interaction to execute arbitrary code in the context of the current user. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 9.1 (v3.1).
What to do
- Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later.
- Restrict network access to Campaign servers while patching.
- Review logs for anomalous unauthenticated requests to privileged endpoints.
Management note
Authorization logic that fails open is an access-control design failure, not a typo. The fix ships in the same bulletin as the other Campaign flaws, so one upgrade covers the set.