CVE-2026-104353 in Campaign Classic
Summary
by MITRE • 10/27/2026
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
Adobe Campaign Classic contains a critical security flaw classified as an OS Command Injection, which corresponds to CWE-78 in the Common Weakness Enumeration standard. This vulnerability arises from improper neutralization of special elements used within operating system commands executed by the application. The root cause lies in insufficient validation or sanitization of user-supplied input before it is incorporated into shell commands. When the software processes data that includes metacharacters such as semicolons, pipes, ampersands, or backticks without proper escaping, these characters can alter the intended command structure. This allows an attacker to inject additional malicious commands that are then executed by the underlying operating system with the privileges of the process running Adobe Campaign Classic.
The operational impact of this vulnerability is severe because it enables arbitrary code execution within the context of the current user account hosting the application services. Unlike vulnerabilities requiring complex social engineering or specific file uploads, exploitation does not require any interaction from a legitimate end-user. An attacker can trigger the flaw remotely if the vulnerable endpoint is accessible over the network. The scope change indicates that the impact extends beyond just compromising the immediate process; it potentially allows for lateral movement within the system environment where Adobe Campaign Classic resides. This means an adversary could pivot to other systems, exfiltrate sensitive customer data managed by the campaign platform, or establish persistent access mechanisms on the host server.
From a tactical perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically under sub-techniques involving shell commands such as sh or cmd.exe depending on the operating system environment. Attackers typically leverage OS command injection to execute reconnaissance commands, download additional payloads from remote servers, or modify configuration files to maintain persistence. The lack of user interaction requirement makes this a high-risk vector for automated exploitation tools and widespread attacks against unpatched instances. Organizations relying on Adobe Campaign Classic must recognize that even low-privileged accounts interacting with vulnerable endpoints can escalate their privileges significantly if the application process itself runs with elevated system rights, which is common in enterprise deployments to ensure proper access to databases and file systems.
Mitigation strategies should prioritize immediate patching by applying the latest security updates provided by Adobe for Adobe Campaign Classic. These patches typically include code changes that enforce strict input validation and parameterized command execution rather than string concatenation when invoking system processes. In environments where patching is delayed, network-level controls such as Web Application Firewalls can be configured to detect and block common OS injection patterns in HTTP requests targeting the application. Additionally, administrators should review the principle of least privilege by ensuring that the Adobe Campaign Classic service account operates with minimal necessary permissions on the operating system. This limits the potential damage if an exploitation attempt succeeds. Regular security audits focusing on input handling across all user-facing interfaces are essential to identify and remediate similar injection points before they can be weaponized by malicious actors.