Description

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-25T18:18:04.967Z",
  "pubdate": "2026-08-25T18:18:04.967Z",
  "executiveSummary": "Adobe Campaign Classic (ACC) contains an OS Command Injection vulnerability classified as Improper Neutralization of Special Elements used in an OS Command. This critical security flaw allows an unauthenticated remote attacker to execute arbitrary system commands with the privileges of the application process. The vulnerability poses a severe risk to confidentiality, integrity, and availability, as successful exploitation facilitates full system compromise. The attack vector is particularly dangerous as it does not require user interaction, meaning a threat actor can trigger the exploit remotely without any participation from legitimate users or administrators. The scope of this vulnerability is categorized as changed, implying that the impact extends beyond the immediate application to the underlying operating system environment. Given the potential for arbitrary code execution (ACE), organizations should prioritize identifying accessible instances of Adobe Campaign Classic and applying necessary security controls or vendor-supplied patches to neutralize the attack surface.",
  "technicalDetails": "The vulnerability resides within Adobe Campaign Classic (ACC) due to insufficient validation and sanitization of user-supplied input before passing such data to system-level calls or shell execution environments. The root cause is categorized under Improper Neutralization of Special Elements used in an OS Command, where the application fails to properly escape or filter shell metacharacters such as semicolons, pipes, or ampersands. By injecting these special characters into an input field or parameter processed by the application, an attacker can manipulate the intended command logic, effectively concatenating malicious instructions to the legitimate system process.\nThe exploitation process initiates when an attacker crafts a malicious payload designed to escape the application's expected input format. When the ACC service processes this input—typically through a vulnerable internal function or API endpoint—the underlying OS executes the attacker-supplied commands with the permissions of the user context running the Adobe Campaign service. This bypasses standard application-layer security controls because the malicious instructions are executed directly at the OS shell or process spawning layer.\nThe attack flow does not necessitate authentication, allowing an external actor to interact directly with exposed network services associated with the ACC platform. Because no user interaction is required, the attack can be automated and performed silently. The scope change indicates that the vulnerability allows for a pivot from the application layer to the host environment. Once the malicious command is executed, the attacker can leverage this primitive to download additional malware, establish reverse shells, escalate privileges if the service is running with excessive permissions, or exfiltrate sensitive data stored within the ACC instance and connected database systems.\nPost-exploitation activities are limited only by the privileges of the service account configured for the ACC process. If the service is improperly configured to run with administrative or root-level privileges, the attacker can achieve full control over the host operating system. Furthermore, the attacker can use the compromised server as a foothold to perform lateral movement within the enterprise network, targeting backend infrastructure or internal data repositories."
}