Advisory · CVE-2026-89276
Code injection in Adobe Campaign Classic for low-privileged attackers
An improper code-generation flaw in Adobe Campaign Classic lets a low-privileged attacker execute arbitrary code with changed scope. CVSS 9.9.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-89276
CWE-94 - Action timing
- Immediate
Explain it like I’m five
A suggestion box promises to pass ideas to the boss, but whatever is written on the slip gets carried out as orders. A junior employee writes orders instead of ideas.
- 01Low-privileged access
An attacker holds a low-privileged account on Adobe Campaign Classic.
- 02Malicious input
They submit input that the application fails to control during code generation.
- 03Code executes
The injected code runs in the context of the current user with changed scope.
- 04Impact
Arbitrary code execution on the Campaign server, no user interaction required.
What happened
Adobe security bulletin APSB26-142 includes CVE-2026-89276, an improper control of code generation (CWE-94) in Adobe Campaign Classic. A low-privileged attacker can exploit it without user interaction to execute arbitrary code in the context of the current user with changed scope. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 9.9 (v3.1).
What to do
- Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later.
- Restrict network access to Campaign servers while patching.
- Review logs for code-execution indicators from low-privileged sessions.
Management note
Low-privilege code execution collapses the value of role separation inside the product. The same upgrade that fixes the unauthenticated RCEs fixes this one.