External risk intelligence

Adobe Campaign Classic OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-76197

Adobe Campaign Classic is an enterprise marketing automation platform frequently deployed as a web-accessible application or service for managing campaigns, which often requires exposure to external networks or integration points for web-based marketing activities.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Adobe Campaign Classic is impacted by a critical vulnerability that could allow an attacker to execute arbitrary code without any user interaction. This could lead to significant compromise of the affected system.

Code execution flaw in marketing software.
Critical vulnerability with high impact potential.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input to a network-accessible Adobe Campaign Classic component. This input would be processed in a way that allows the attacker to inject and execute operating system commands, leading to arbitrary code execution within the application's environment. The vulnerability allows for code execution without any interaction from a legitimate user.

Network access required.
OS command injection via crafted input.
Arbitrary code execution and scope change.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Adobe Campaign Classic could allow an attacker to execute arbitrary code on a system, potentially impacting the integrity and availability of the application and its underlying operating system. When supported by the advisory, this threat could affect the system where Adobe Campaign Classic is installed, without requiring user interaction or prior authentication.

System-level code execution.
Remote, unauthenticated network access.
Compromise of the affected system.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

This critical OS Command Injection vulnerability in Adobe Campaign Classic requires immediate attention from teams responsible for application security and infrastructure management. The first practical move is to identify all instances of Adobe Campaign Classic within your environment, assess their exposure (especially external network reachability), confirm their business criticality, and then assign ownership for remediation. This will involve coordinating with application owners, infrastructure, and potentially vendor management to plan and execute a response based on the identified risk.

Application and Infrastructure teams own the issue.
Verify external exposure and business criticality.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Campaign Classic?

Adobe Campaign Classic is an enterprise-grade marketing automation platform. Organizations use it to design, execute, and manage complex cross-channel marketing campaigns. It functions as a central hub for customer data, email marketing, and personalized messaging, often requiring connectivity with external networks to track interactions and deliver content.

What does this OS Command Injection vulnerability mean for CVE-2026-76197?

This vulnerability, classified as CWE-78, occurs when software fails to properly sanitize input before passing it to an operating system shell. In this case, the vulnerability allows an attacker to inject their own malicious commands into the system. Instead of the application only running expected tasks, it executes the attacker's instructions, effectively giving them control over the underlying environment.

How is this vulnerability triggered by an attacker?

An attacker triggers this flaw by sending specially crafted input to a network-accessible component of the software. Because the system fails to neutralize this input, the command is executed immediately. This does not require the attacker to trick a user into clicking a link or performing any action, nor does it require prior authentication to the application.

Do I need to worry if my Adobe Campaign Classic instance is not on the internet?

Halo Surface Signal indicates that this software is often deployed as a web-accessible service, making internet-facing instances a primary concern. If your instance is strictly internal, the attack surface is smaller, but you should still verify if any internal network segments have unauthorized access to the application, as the flaw is network-based.

What are the first steps for managing CVE-2026-76197?

Start by performing a thorough inventory to locate all active instances of Adobe Campaign Classic in your infrastructure. Once identified, categorize them by business criticality and network exposure level. Coordinate with your application and infrastructure teams to prioritize patching or restricting access for the most exposed systems to mitigate the risk of arbitrary code execution.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.