CVE-2026-73369 in Campaign Classic
Summary
by MITRE • 09/22/2026
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
Adobe Campaign Classic contains a critical security flaw classified as Improper Control of Generation of Code, commonly referred to as code injection. This vulnerability arises from insufficient validation and sanitization of input data within the application's processing logic. When the system generates or executes dynamic code based on user-supplied inputs without adequate safeguards, it allows an attacker to inject malicious commands that are subsequently interpreted by the underlying environment. The root cause lies in the failure to strictly enforce boundaries between trusted configuration parameters and untrusted external data streams, leading to a situation where arbitrary script fragments can be embedded into executable contexts.
The operational impact of this vulnerability is severe due to its potential for remote code execution without any prior user interaction. Unlike many other web application vulnerabilities that require social engineering or specific clicks from legitimate users, this flaw can potentially be triggered automatically by an attacker who has network access to the Adobe Campaign Classic instance. Once exploited, the malicious code executes with the privileges of the current process context. This means if the service is running under a high-privilege account, such as root or administrator, the compromise extends beyond simple data theft to full system control. The scope change indicates that the impact may extend beyond the immediate application boundary, potentially affecting other services or systems accessible by the compromised user account.
From an industry standard perspective, this vulnerability aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection). It also maps to MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically where attackers leverage injected scripts to maintain persistence or escalate privileges. The lack of user interaction requirement places it in a high-risk category for automated exploitation tools found on the dark web. Attackers can utilize this flaw to deploy backdoors, exfiltrate sensitive customer data managed by the campaign platform, or pivot into deeper network segments if lateral movement is possible from the compromised host.
Mitigation strategies must focus on immediate remediation and long-term architectural hardening. The primary defense is applying the official security patch provided by Adobe as soon as it becomes available for the specific version of Campaign Classic in use. Until patches are applied, administrators should restrict network access to the application interface using strict firewall rules, allowing connections only from trusted IP addresses or internal subnets. Additionally, implementing Web Application Firewalls with robust injection detection signatures can help block exploit attempts at the perimeter layer. Input validation must be rigorously enforced across all entry points, ensuring that any data used in dynamic code generation is strictly typed and sanitized against known malicious patterns. Regular security audits and penetration testing should also be conducted to identify similar weaknesses in custom extensions or integrations within the Adobe Campaign ecosystem.