Description

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-25T18:18:05.110Z",
  "pubdate": "2026-08-25T18:18:05.110Z",
  "executiveSummary": "Adobe Campaign Classic (ACC) contains an OS Command Injection vulnerability classified under the Improper Neutralization of Special Elements used in an OS Command. This vulnerability allows an unauthenticated remote attacker to execute arbitrary system commands within the security context of the application process. The flaw carries a significant risk, as it facilitates full system compromise, data exfiltration, or lateral movement within the network. Because the vulnerability involves a change in scope, the impact extends beyond the immediate application to the underlying operating system. Exploitation requires no user interaction, making it a critical threat vector for internet-facing instances. Successful execution results in arbitrary code execution, granting the attacker the same permissions as the service account running Adobe Campaign Classic.",
  "technicalDetails": "The vulnerability originates from the improper sanitization or validation of user-supplied input before it is passed to a system-level shell or command execution function within Adobe Campaign Classic. By injecting malicious shell metacharacters—such as semicolons, pipes, or command substitution operators—into vulnerable application parameters, an attacker can escape the intended input boundaries.\nThe attack flow initiates when the application processes a specially crafted request containing malicious command sequences. Because the application fails to neutralize these special elements, the underlying operating system executes the attacker-supplied payload concurrently with or in place of the intended application process. This behavior allows for the injection of arbitrary shell commands that the application process will execute with its current privilege level.\nThe vulnerability is characterized by a change in scope, meaning the exploitation affects the security domain of the host operating system rather than just the application's internal data. As no authentication or user interaction is required, an attacker can trigger the execution flow remotely over the network. The payload behavior is limited only by the permissions of the service account executing the Adobe Campaign Classic process; however, if the service runs with elevated privileges, the attacker gains equivalent control over the host.\nPost-exploitation, an attacker can leverage this primitive to install persistent backdoors, deploy malware, perform reconnaissance on the local network, or exfiltrate sensitive data stored within the Adobe Campaign databases. Because the vulnerability resides in the application's input processing logic, it is highly likely that this flaw is accessible via various web-based endpoints associated with the ACC platform. Defensive bypasses may be possible if the application relies on weak denylisting rather than robust input parameterization or strict allowlisting of permissible characters."
}