External risk intelligence

Adobe Campaign Classic OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-104353

Adobe Campaign Classic is an enterprise-grade marketing automation platform. These systems are frequently deployed as internet-facing web applications or integrated into public-facing campaign and email marketing workflows, making the interface reachable via the network in many standard deployment scenarios.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Adobe Campaign Classic has a critical vulnerability allowing unauthorized code execution without user interaction. This could enable a low-privileged attacker to take control of systems running the software.

Command injection flaw in Adobe Campaign Classic.
Critical flaw could lead to code execution.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker with low privileges could exploit an OS command injection vulnerability in Adobe Campaign Classic by sending specially crafted data over the network. This could allow them to execute arbitrary code on the affected system, potentially leading to a full compromise. Exploiting this vulnerability does not require any interaction from a user.

Entry Condition: Low-privileged network access.
Trigger Point: Specially crafted input to a vulnerable component.
Resulting Risk: Arbitrary code execution in the user's context.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Adobe Campaign Classic could allow a low-privileged attacker to execute arbitrary code on the system, potentially impacting the security and integrity of the underlying operating system and any data processed by the application. The exploitation does not require user interaction, and the scope change indicates a broader impact beyond the initial application.

Arbitrary code execution on affected systems.
Attacker exploits via network without interaction.
Compromised system integrity and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the nature of OS Command Injection in Adobe Campaign Classic, responsibility likely falls to the platform or infrastructure teams managing the Campaign Classic deployment, in coordination with application owners and potentially the vendor-management team if third-party support is involved. The first practical step is to identify all Campaign Classic instances, confirm their network exposure and business criticality, and then engage the accountable owners to prioritize remediation based on risk assessment.

Platform or application owners should lead remediation.
Verify network reachability and critical assets.
Plan and coordinate vendor engagement for fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Campaign Classic?

Adobe Campaign Classic is an enterprise marketing automation platform designed to manage complex customer data, coordinate cross-channel marketing campaigns, and automate personalized communications like email and direct mail. It functions as a central hub where organizations store customer profiles and execute large-scale marketing workflows, often requiring integration with various web-based services and databases to handle high-volume interactions.

What does CVE-2026-104353 mean by OS Command Injection?

This vulnerability, classified as CWE-78, occurs when the software fails to properly filter input before passing it to the underlying operating system. Because the application processes this data, an attacker can insert their own system commands into the input. The software then accidentally executes these commands, granting the attacker the same rights as the application itself on the server.

How does an attacker trigger this command injection?

An attacker triggers this by sending specially crafted data over the network to a vulnerable component within the software. Importantly, this does not require a user to click a link, open an attachment, or take any other action. If the attacker has even low-privileged access, they can send the malicious input directly to the system to initiate the exploit without any human interaction.

Is my Adobe Campaign Classic instance at risk?

According to Halo Surface Signal, this software is frequently deployed as an internet-facing web application. Because it is often integrated into public-facing marketing workflows, the interface is typically reachable over the network. You should be concerned if your instance is accessible from the internet, as that significantly increases the likelihood that it could be reached by an external attacker.

What should I do first to address this CVE?

Begin by identifying every instance of Adobe Campaign Classic within your environment. Once you have a complete list, verify which ones are reachable over the network and determine their business criticality. Coordinate with your platform and infrastructure teams to review the vendor's guidance, confirm if your specific version is impacted, and prioritize these systems for necessary updates to eliminate the command injection risk.

References

www.adobe.com/trust/security/products/campaign/apsb26-162.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.