Adobe Campaign Classic contains an unauthenticated code injection flaw rated CVSS 10.0 that allows remote arbitrary code execution with no user interaction required.
What Is It
CVE-2026-75699 is an Improper Control of Generation of Code vulnerability (CWE-94) in Adobe Campaign Classic (ACC). Per Adobe's PSIRT description, the flaw "could result in arbitrary code execution in the context of the current user," and exploitation "does not require user interaction."
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: network attack vector, low complexity, no privileges, no user interaction, and a changed scope with high impact across confidentiality, integrity, and availability. That combination produces a base score of 10.0 (CRITICAL), with an exploitability subscore of 3.9 and an impact subscore of 6.0.
Why It Matters
Three elements of the vector drive the severity. PR:N and UI:N mean an attacker needs no credentials and no victim action; reachability is the only prerequisite. S:C (scope changed) means the impact does not stop at the vulnerable component; the vulnerability can affect resources beyond its own security authority. And code injection yields execution, not just data disclosure.
Adobe Campaign Classic is a marketing campaign platform, and instances are frequently network-reachable by design. The NVD record remains in "Awaiting Analysis" status, published 2026-09-22 and last modified the same day.
What's Vulnerable
Per the Adobe-supplied affected-version data:
- Affected: Adobe Campaign Classic, all versions from 0 up to and including 7.4.4 build 9401
- Unaffected: 7.4.4 build 9402 and later
The vendor default status for other versions is listed as unaffected. No CPE entries have been published yet.
Patch Status
Adobe has shipped a fix. Upgrading Adobe Campaign Classic to 7.4.4 build 9402 remediates the issue. Given a 10.0 score against an unauthenticated network-facing vector, organizations running affected builds should prioritize this outside the routine patch cycle.
Sources
- NVD, CVE-2026-75699: https://nvd.nist.gov/vuln/detail/CVE-2026-75699
- Adobe Security Bulletin APSB26-142 (Adobe Campaign): https://helpx.adobe.com/security/products/campaign/apsb26-142.html