Adobe disclosed CVE-2026-76197, a CVSS 10.0 OS command injection vulnerability in Adobe Campaign Classic that allows unauthenticated remote attackers to execute arbitrary code without any user interaction.
What Is It
CVE-2026-76197 is an improper neutralization of special elements used in an OS command; classic command injection, tracked as CWE-78. Adobe Campaign Classic fails to sanitize input that is passed into an operating system command, letting an attacker inject their own commands. The result is arbitrary code execution on the affected host; the advisory does not specify the execution context, but command injection of this kind would typically run with the privileges of the Campaign Classic service process. No authentication and no victim interaction are involved.
The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, a base score of 10.0, CRITICAL. Every exploitability factor is maxed out: network-reachable, low attack complexity, no privileges required, and no user interaction. Scope is changed, meaning the impact extends beyond the vulnerable component's security boundary.
Why It Matters
A 10.0 is rare. This combination, remote, pre-authentication, no clicks required, full confidentiality/integrity/availability impact, with a scope change, is the profile attackers look for first. Adobe Campaign Classic is a marketing campaign orchestration platform that typically sits with access to large customer datasets and internal messaging infrastructure, so code execution on one of these hosts is unlikely to be a contained event.
As of this writing, CVE-2026-76197 does not appear in the CISA Known Exploited Vulnerabilities catalog, so active exploitation has not been confirmed by CISA. That is not a reason to defer patching on a perfect-score, no-interaction RCE.
What's Vulnerable
Per Adobe's advisory data:
- Adobe Campaign Classic (ACC) v7: all versions up to and including 7.4.4 build 9400 are affected.
- ACC v7: 7.4.4 build 9401 is listed as unaffected.
The default status for the product is "affected," so treat any ACC v7 deployment at or below build 9400 as vulnerable until verified otherwise.
Patch Status
Adobe's advisory data lists 7.4.4 build 9401 as unaffected, which indicates a fixed build is available. Upgrade Adobe Campaign Classic v7 to build 9401 or later, and refer to Adobe security bulletin APSB26-134 for the vendor's remediation guidance and for confirmation of the correct target version for your deployment. No workaround or mitigation is documented in the supplied source material.
The CVE record is currently in "Received" status at NVD, published 2026-08-25, so enrichment (including CPE data) is still pending.
Sources
- NVD, CVE-2026-76197: https://nvd.nist.gov/vuln/detail/CVE-2026-76197
- Adobe Security Bulletin APSB26-134: https://helpx.adobe.com/security/products/campaign/apsb26-134.html
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog