9.9
CriticalCVSS 3.1 · from adobe
CVE-2026-104353
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Adobe Campaign Classic · OS command injection · CWE-78AffectedAdobe Campaign Classic
FixUpdate to 7.4.4 build 9403 or newer
PublishedOct 27, 17:03 · adobe
ScoredOct 27 · 9.9 · adobe
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
From adobe
Affected and fixed versions
ProductAffectedFixed inAdobe Campaign Classicup to 7.4.4 build 9402–Adobe Campaign ClassicNot affected7.4.4 build 9403
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known