CVE-2026-84412 in Campaign Classic
Summary
by MITRE • 09/22/2026
Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/22/2026
Adobe Campaign Classic contains a critical security flaw classified as Improper Control of Generation of Code, commonly referred to as code injection. This vulnerability arises from insufficient validation and sanitization mechanisms within the application's input handling routines. When the system processes specific data inputs, it fails to adequately distinguish between executable commands and benign data strings. Consequently, an attacker can inject malicious script or command sequences that are subsequently interpreted by the underlying operating system or application engine as legitimate instructions. This fundamental architectural weakness allows for the unauthorized generation of code within the execution environment where Adobe Campaign Classic is running.
The operational impact of this vulnerability is severe due to its potential for arbitrary code execution in the context of the current user account hosting the service. Because exploitation does not require any form of user interaction, such as clicking a link or opening an attachment, the attack vector is considered remote and non-interactive. This significantly lowers the barrier for entry for threat actors, allowing them to target vulnerable instances automatically through network requests alone. Once executed, the injected code runs with the same privileges as the Adobe Campaign Classic process itself. Depending on how the service is configured, this could grant an attacker full control over the server, enabling data exfiltration, modification of system configurations, installation of backdoors, or use of the compromised host as a pivot point for further attacks within the internal network infrastructure.
From a classification perspective, this issue aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection). The attack methodology closely mirrors techniques documented in the MITRE ATT&CK framework under Command and Scripting Interpreter abuse, specifically involving remote code execution via injection vectors. The lack of user interaction places it firmly within the Remote Code Execution category, highlighting its high severity rating in standard vulnerability scoring systems such as CVSS. Organizations relying on Adobe Campaign Classic for marketing automation must recognize that this is not a minor configuration error but a critical breach point that compromises the integrity and confidentiality of the entire platform.
Mitigation strategies should prioritize immediate patching to the latest version provided by Adobe, which includes specific fixes for input validation logic in affected components. In environments where immediate patching is not feasible due to operational constraints, network-level controls such as Web Application Firewalls can be configured to detect and block known injection patterns associated with this vulnerability type. Additionally, administrators should enforce strict least-privilege principles by ensuring the Adobe Campaign Classic service runs under a dedicated user account with minimal system permissions rather than administrative or root privileges. This limits the potential blast radius if an exploitation attempt succeeds. Regular security audits of input handling code and implementation of rigorous parameterized query practices are also essential to prevent similar injection vulnerabilities in custom extensions or integrations within the platform.