CVE-2026-76197: Critical Adobe Campaign Classic Flaw Allows Unauthenticated Remote Code Execution

Adobe has patched a critical command-injection vulnerability in Adobe Campaign Classic that carries the maximum CVSS score of 10.0 and can allow arbitrary code execution without authentication or user interaction.

Adobe disclosed the issue on August 25, 2026, as part of security bulletin APSB26-134. The vulnerability, tracked as CVE-2026-76197, affects Adobe Campaign Classic v7 installations running 7.4.4 build 9400 and earlier on Windows and Linux. Adobe rates the issue Critical and recommends upgrading to 7.4.4 build 9401.

A Maximum-Severity Vulnerability

CVE-2026-76197 is classified as CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection).

According to Adobe, successful exploitation could result in arbitrary code execution. The vulnerability has received a CVSS v3.1 score of 10.0, the maximum possible rating.

The published CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The rating indicates that the vulnerability can be reached remotely, has low attack complexity, requires no privileges and no user interaction, and could have high confidentiality, integrity, and availability impact.

The CVE record and NVD also identify the issue as an OS command injection vulnerability affecting Adobe Campaign Classic.

Adobe Campaign Classic Under the Spotlight

Adobe Campaign Classic is used for enterprise marketing automation and campaign management. Because the affected software can be deployed as an on-premise component, a remotely reachable vulnerability in the platform can become particularly important for organizations that expose the relevant infrastructure to untrusted networks.

Adobe's security bulletin makes an important distinction about deployment models.

The advisory applies to:

• Fully on-premise Adobe Campaign Classic deployments
• On-premise components of hybrid deployments

Adobe says that Adobe-hosted instances have already been remediated and require no customer action for this bulletin.

What Makes CVE-2026-76197 So Serious?

The combination of network reachability, no required privileges, no user interaction, and arbitrary code execution places CVE-2026-76197 among the most severe vulnerabilities disclosed in the August 2026 Adobe security cycle.

A successful attack could potentially give an attacker the ability to execute code with the privileges of the affected application process.

Depending on the application's operating environment and permissions, that could expose sensitive information, allow unauthorized modification of application resources, or disrupt services.

The vulnerability therefore presents a potentially serious risk for organizations operating vulnerable on-premise Campaign Classic infrastructure.

Affected Versions

Adobe assigned the update a Priority 1 rating and recommends customers apply the newest available version.

No Exploitation Reported by Adobe

Despite the maximum CVSS score, Adobe stated that it is not aware of exploits in the wild for any of the vulnerabilities addressed by APSB26-134 at the time of publication.

This distinction is important. A vulnerability can be critical and remotely exploitable without there being confirmed evidence of active exploitation.

Security teams should nevertheless treat the issue as high priority because the vulnerability requires neither authentication nor user interaction and has a maximum CVSS score.

Adobe Releases the Fix

Adobe released Adobe Campaign Classic v7 7.4.4 build 9401 to address the affected issues.

The vendor recommends that organizations running affected on-premise installations upgrade to the latest available release.

For hybrid environments, administrators should specifically verify the version of their on-premise Campaign Classic components, since Adobe states that the hosted portions of hybrid deployments have already been remediated.

What Security Teams Should Do

Organizations running Adobe Campaign Classic should:

1. Identify all on-premise Campaign Classic v7 installations.
2. Check whether any system is running 7.4.4 build 9400 or earlier.
3. Upgrade affected installations to 7.4.4 build 9401 or the latest supported security release.
4. Review network exposure and restrict unnecessary access to Campaign Classic infrastructure.
5. Monitor affected hosts for unusual process execution, unexpected outbound connections, or other anomalous activity.
6. Review security logs around internet-facing Campaign Classic systems.
7. Treat hybrid deployments separately and verify that all on-premise components have received the update.

Restricting network exposure can reduce the attack surface, but it should be considered a compensating control rather than a replacement for applying the vendor's security update.

Why This Disclosure Matters

CVE-2026-76197 highlights the security risks associated with enterprise applications that combine network-facing functionality with operating-system command execution.

The vulnerability is particularly notable because its CVSS vector assigns no privileges required and no user interaction, while the impact ratings for confidentiality, integrity, and availability are all high.

For defenders, the key takeaway is straightforward: vulnerable on-premise Campaign Classic systems should be identified and patched quickly, even though Adobe has not reported exploitation in the wild.

Conclusion

CVE-2026-76197 is a critical OS command injection vulnerability in Adobe Campaign Classic that can lead to arbitrary code execution.

The vulnerability affects Adobe Campaign Classic v7 7.4.4 build 9400 and earlier on Windows and Linux and carries a CVSS v3.1 score of 10.0.

Adobe addressed the issue in 7.4.4 build 9401 and classified the security update as Priority 1.

While Adobe reported no known exploitation in the wild when the bulletin was published, the combination of remote reachability, no authentication requirement, no user interaction, and potential arbitrary code execution makes this a vulnerability that enterprise security teams should prioritize.

Sources

• CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-76197
• Adobe Security Bulletin APSB26-134: https://helpx.adobe.com/security/products/campaign/apsb26-134.html
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-76197