Adobe disclosed a critical OS command injection flaw in Adobe Campaign Classic that, per the vendor advisory, could result in arbitrary code execution in the context of the current user. The CVSS vector indicates the flaw is network-reachable and requires neither privileges nor user interaction, and it carries the maximum CVSS base score of 10.0.
What Is It
CVE-2026-76195 is an improper neutralization of special elements used in an OS command (CWE-78) affecting Adobe Campaign Classic (ACC). Per Adobe's advisory, the flaw "could result in arbitrary code execution in the context of the current user." Exploitation does not require user interaction, and the CVSS scope is marked as changed; meaning a successful attack impacts resources beyond the vulnerable component's own security authority.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, yielding a base score of 10.0 (CRITICAL). Network-reachable, low complexity, no privileges, no user interaction, total impact across confidentiality, integrity, and availability.
Why It Matters
The scoring indicates an attacker needs nothing but network access to the ACC instance. CISA's SSVC assessment rates the technical impact as total and marks the vulnerability automatable: yes: meaning the reconnaissance, weaponization, and exploitation steps can all be scripted at scale. That combination is the profile that mass-scanning campaigns favor.
CISA's SSVC exploitation status is currently listed as none, and there is no CISA KEV entry for this CVE, active exploitation has not been confirmed as of this writing. Given the automatable rating and the low attack complexity, that status is worth monitoring closely.
What's Vulnerable
Adobe lists Adobe Campaign Classic as affected with a default status of affected:
- ACC v7: all versions up to and including 7.4.4 build 9400
- Not affected: ACC v7 7.4.4 build 9401 and later
Organizations running ACC v7 should verify their exact build number, not just the 7.4.4 version string; the fix boundary sits at the build level.
Patch Status
Adobe has shipped a fix. Build 7.4.4 build 9401 is listed as unaffected, making the upgrade to that build or later the remediation path. Details are published in Adobe security bulletin APSB26-134. No workarounds or mitigations are documented in the supplied source material.
The CVE record is currently in NVD status Received (published 2026-08-25), so NVD-assigned CPE data and secondary analysis are not yet available.
Sources
- NVD, CVE-2026-76195: https://nvd.nist.gov/vuln/detail/CVE-2026-76195
- Adobe Security Bulletin APSB26-134: https://helpx.adobe.com/security/products/campaign/apsb26-134.html