A critical (CVSS 9.9) OS command injection flaw in Adobe Campaign Classic lets a low-privileged attacker run arbitrary code over the network without any user interaction.
What Is It
CVE-2026-104353 is an OS command injection vulnerability (CWE-78) in Adobe Campaign Classic (ACC). Adobe's PSIRT says the product does not properly neutralize special elements used in an OS command. An attacker can use this to execute arbitrary code in the context of the current user.
NVD published the record on 2026-10-27, and its status is currently "Received." Adobe tracks the issue in security bulletin APSB26-162.
Why It Matters
Adobe scores the flaw 9.9 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H:
- Network-reachable: it can be exploited remotely, and attack complexity is low.
- Low privileges required: any authenticated low-privileged account is enough. No user interaction is needed.
- Scope changed: a successful exploit can affect resources beyond the vulnerable component.
- High impact: confidentiality, integrity and availability impacts are all rated high.
Campaign Classic platforms usually hold customer data and marketing infrastructure. Any organization that gives low-privileged accounts access to ACC should treat this as a high-priority exposure.
KEV status: The supplied CISA Known Exploited Vulnerabilities data has no entry for this CVE. KEV does not currently confirm active exploitation, and the source material contains no exploitation reports.
What's Vulnerable
According to Adobe's affected-version data:
- Product: Adobe Campaign Classic
- Affected: all versions up to and including 7.4.4 build 9402
- Not affected: 7.4.4 build 9403
NVD does not list any specific CPEs yet.
Patch Status
Adobe lists 7.4.4 build 9403 as unaffected, so that build is the remediation target. Administrators should:
- Check which ACC build each instance is running.
- Upgrade any instance at 7.4.4 build 9402 or earlier to build 9403 or later.
- Follow the guidance in Adobe bulletin APSB26-162.
There is no CISA KEV required action or due date, because the CVE is not in the KEV catalog. Given the critical score and the low privileges needed to exploit it, patch promptly anyway.