CVE-2026-75723

Executive Summary

CVE-2026-75723 is an Incorrect Authorization (CWE-863) vulnerability in Adobe Campaign Classic (ACC) that permits an unauthenticated, network-reachable attacker to execute arbitrary code in the context of the current user. It carries a maximum CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) because exploitation requires no privileges or user interaction and the vulnerable component's security scope is changed. No patch, workaround, public proof-of-concept, or affected version range has been published by any tracked source, and the CVE has not been added to CISA KEV.

Technical Analysis

The NVD description classifies this issue as an Incorrect Authorization vulnerability (CWE-863) in Adobe Campaign Classic. CWE-863 is a broad authorization-correctness class: the product performs an authorization check, but the check is logically wrong — it permits an action that should be denied, evaluates the wrong principal, applies the wrong policy to the requested resource, or fails to bind the authorization decision to the resource actually being acted upon. Unlike a missing-authorization flaw (CWE-862), the control exists but its logic does not enforce the intended access decision.

The observable consequence stated in the advisory is arbitrary code execution in the context of the current user. This means the authorization defect bypasses the boundary that separates an unauthenticated or unprivileged caller from an ACC function capable of influencing code execution. Because AV:N and PR:N are both set, the vulnerable surface is reachable over the network without prior credentials; because UI:N is set, no victim must click, open, or confirm anything. Because S:C (Scope: Changed) is set, the security authority that authorizes the vulnerable component is not the same authority under which the resulting code executes — the exploit escapes the component's intended privilege boundary, which is consistent with an authorization logic error that grants access to a more privileged execution context than the one that was validated.

ACC is an enterprise marketing-automation platform: it processes campaign data, executes scheduled and event-driven workflows, runs JavaScript-based activities, and integrates with external systems (databases, application servers, delivery/execution servers). These architectural traits place high-value functionality behind the authorization layer that this flaw weakens. The specific vulnerable function, endpoint, module, and parameter set are not disclosed in the supplied data. No authoritative technical detail beyond the vulnerability class, the impact type, and the severity vector is available. Any claim about which ACC subsystem (for example web application, workflow engine, or delivery component) is affected would be speculation and is therefore deliberately not asserted here.

Root cause at the class level: an authorization decision that returns "allow" for a caller or operation that the intended policy should reject. In practice such defects stem from privilege checks performed against the wrong identity attribute, checks that are skipped on certain request paths, policy enforcement at a layer that a different code path bypasses, or resource-to-policy mappings that are not enforced on one of several equivalent interfaces. Given CWE-863 and the arbitrary-code-execution impact, the practical mechanism is that the flawed check lets an attacker reach executable functionality in ACC. No further code-level detail can be stated without fabrication.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The attack chain below is inferred strictly from the vulnerability class (CWE-863) and the NVD impact statement. It does not name any function, endpoint, parameter, or file path, because none are disclosed.

1. Reconnaissance / target identification. ACC is typically deployed as an internet-facing or partner-facing marketing platform, frequently identifiable by product banners, login pages, and application paths. An attacker maps reachable ACC instances and determines which interfaces are exposed without authentication. No credentials or user interaction are required per the CVSS vector (PR:N/UI:N).

2. Triggering the specific flaw class. The attacker sends a request to an ACC interface whose authorization logic is incorrect. The request targets an operation the policy should deny to the attacker's privilege level; the flawed check (CWE-863) evaluates it as authorized. The defect is on the server side and remote-triggerable (AV:N/AC:L), so a single crafted request is sufficient — no race condition, no local component, no auxiliary precondition is indicated.

3. Payload / execution method. At the vulnerability-class level, once the incorrect authorization check is satisfied, the attacker reaches an ACC capability that processes attacker-supplied input in an executable context, resulting in arbitrary code execution in the context of the current user. The specific injection point or executed construct is not published; the mechanism cannot be described further without inventing implementation detail.

4. Post-exploitation impact. With S:C and C:H/I:H/A:H, successful exploitation changes the security scope and yields full loss of confidentiality, integrity, and availability on the impacted host or component. Realistic post-exploitation objectives for an ACC compromise include reading or altering campaign and recipient/marketing data, modifying scheduled workflow behavior, redirecting or injecting content into outbound campaigns, harvesting integration credentials, and pivoting to connected database and application servers. Because code executes "in the context of the current user," the effective blast radius follows the privileges of that context rather than the scope of the vulnerable component — the reason Scope is marked Changed.

Absence of a public exploit does not imply low risk. A CVSS 10.0 authorization bypass with arbitrary code execution and no user interaction is an attractive target for opportunistic mass scanning once a working technique circulates. Treat the absence of PoC as a timing advantage, not as a mitigation.

Impact Assessment

Business impact is severe and spans confidentiality, integrity, and availability, each rated High (C:H/I:H/A:H) with Scope Changed (S:C) for a maximum 10.0 base score. ACC sits on the customer-data path of an enterprise marketing organization, so compromise threatens the integrity of outbound communications, the confidentiality of recipient and campaign data, and the availability of campaign execution. A changed scope means the exploited component can affect resources beyond its own security authority — the classic condition for lateral movement from a web-facing tier into backend execution, data, and integration tiers.

Blast radius considerations: severity is a property of the vulnerability, not of any single deployment. Internet-exposed ACC instances are directly at risk. Internal-only deployments remain exposed to any attacker who reaches the internal network, to compromised partner integrations, and to supply-chain trust relationships, because AV:N/PR:N requires no special position beyond network reachability. Multi-tenant or shared-service ACC deployments increase the number of downstream stakeholders affected by a single compromise. Finally, Patch Confidence is 0/4 — UNPATCHED — so remediation cannot rely on vendor fixes today and must depend on compensating network and authorization controls.

Prioritization: since the CVE is not in CISA KEV and has no public exploit, it does not meet the criteria for emergency federal remediation timelines. However, given the maximum severity, unauthenticated remote reachability, and no available patch, risk-appropriate treatment is to treat this as a high-urgency exposure-management item: reduce the internet attack surface, monitor authorization-abuse telemetry, and track vendor advisory channels for an official fix.

Detection Guidance

The rules below are heuristic detections for the vulnerability class. Field names, product strings, and paths must be tuned to the local ACC deployment before production use. Because no request format, parameter, or payload signature is published, these rules target behavioral indicators — anomalous access decisions against protected ACC operations, unexpected process execution spawned by the ACC web/application tier, and suspicious outbound connections from that tier — rather than a known request pattern.

Sigma Rule

title: Potential Adobe Campaign Classic Incorrect Authorization Exploitation (CVE-2026-75723)
id: 8f3c1b52-6a4d-4e21-9c77-0d5a9e6b3f10
status: experimental
description: Detects anomalous authorization-bypass behavior and unexpected process execution on Adobe Campaign Classic hosts consistent with CWE-863 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75723
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1190
  - attack.initial_access
  - cve.2026.75723
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\certutil.exe'
  selection_cmdline_susp:
    CommandLine|contains:
      - 'whoami'
      - 'net user'
      - 'net group'
      - 'systeminfo'
      - 'DownloadString'
      - 'FromBase64String'
  condition: selection_parent and selection_child and selection_cmdline_susp
falsepositives:
  - Legitimate administrative scripts executed by the ACC application tier
  - Scheduled maintenance tasks on the application server
level: high

YARA Rule

rule CVE_2026_75723_ACC_Incorrect_Authorization
{
    meta:
        description = "Heuristic detection of exploitation artifacts referencing Adobe Campaign Classic incorrect authorization (CVE-2026-75723). No public payload signature exists; rule targets class-level indicators."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75723"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $acc1 = "Adobe Campaign" ascii nocase
        $acc2 = "nl/jsp/" ascii
        $acc3 = "xtk:" ascii
        $auth1 = "Incorrect Authorization" ascii nocase
        $auth2 = "authorization bypass" ascii nocase
        $cve  = "CVE-2026-75723" ascii

    condition:
        uint16(0) == 0x4D5A and filesize < 20MB and
        (2 of ($acc*)) and
        (1 of ($auth*) or $cve)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75723 Potential Adobe Campaign Classic Incorrect Authorization Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/nl/jsp/"; nocase; http.header; content:"Cookie"; nocase; threshold: type both, track by_src, count 20, seconds 60; classtype:attempted-admin; reference:cve,2026-75723; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202675723; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http" and
      http.request.method == "POST" and
      http.url : "/nl/jsp/" ]
  [ process where event.type == "start" and
      process.parent.name : ("java", "javaw") and
      process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "curl.exe", "certutil.exe") ]

Splunk SPL Query

index=web OR index=proxy OR index=sysmon
| eval cve_signal =
    if((match(http_uri, "(?i)/nl/jsp/") AND match(http_method, "POST")), 1, 0)
| where cve_signal=1
| stats count AS request_count,
        dc(src_ip) AS unique_sources,
        values(http_uri) AS uris,
        values(status) AS response_codes,
        min(_time) AS first_seen,
        max(_time) AS last_seen
          by src_ip, http_user_agent
| where request_count > 10
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - request_count
| table src_ip, http_user_agent, request_count, unique_sources, response_codes, uris, first_seen, last_seen

Wazuh OSSEC Rule

<group name="web,adobe_campaign,cve_2026_75723,">
  <rule id="202675723" level="12">
    <if_sid>31100</if_sid>
    <id>^403$|^500$|^200$</id>
    <url>/nl/jsp/</url>
    <method>POST</method>
    <description>CVE-2026-75723: Possible Adobe Campaign Classic incorrect authorization exploitation attempt (unauthenticated POST to protected ACC path)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,initial_access,pci_dss_6.5,gdpr_iv_35.7.d,</group>
  </rule>

  <rule id="202675724" level="14">
    <if_sid>59200</if_sid>
    <field name="parent">java|javaw</field>
    <match>cmd.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe|mshta.exe|certutil.exe</match>
    <description>CVE-2026-75723: Unexpected child process spawned by Adobe Campaign Classic application tier - possible post-exploitation code execution</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>attack,execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Vendor fix is N/A and no workaround has been published. The following guidance is compensating-control based until Adobe issues an advisory and fixed build.

1. Immediate mitigations

• Remove Adobe Campaign Classic interfaces from direct internet exposure where operationally possible; place the platform behind VPN, zero-trust access proxies, or allowlisted reverse proxies. An unauthenticated network-reachable authorization bypass is the primary risk driver.
• Enforce authorization at a trusted front layer: require authenticated sessions at the reverse proxy/WAF for ACC administrative and application paths, and deny unauthenticated POST/GET to protected endpoints regardless of what the application returns.
• Deploy the Sigma, Suricata, Elastic, Splunk, and Wazuh detections above, tuned to local ACC paths, and alert on process creation from the ACC web/application tier.
• Apply least privilege to the service accounts running ACC and its web/application tier; constrain outbound egress so that a code-execution foothold cannot immediately reach backend databases or the internet.
• Restrict and monitor ACC integration credentials (database, messaging, delivery) and rotate them if any anomalous authorized-but-unexpected activity is observed.
• Increase logging verbosity for ACC authorization decisions and retain logs for retro-hunting.

2. Patch/upgrade steps

• No patch reference exists as of this writing. Monitor Adobe's security bulletin channel and the NVD entry for CVE-2026-75723.
• When a fixed ACC version is released, inventory all ACC instances and integration points, test in a non-production environment, and upgrade; ACC version currency is a prerequisite for supportability.
• Track CISA KEV for this CVE; a KEV addition would escalate remediation timelines to emergency handling.

3. Long-term hardening

• Maintain a complete ACC asset inventory including all internet-facing endpoints and integration paths; expose only what business requirements demand.
• Adopt an authorization review program that specifically tests CWE-863 logic errors: enumerate privileged operations, verify each against expected policy for unauthenticated and low-privilege principals, and add regression tests.
• Implement defense-in-depth: WAF/pre-auth proxy enforcement, egress filtering, application-tier process monitoring, and segmentation between the ACC tier and backend data stores.
• Subscribe to vendor advisories and integrate CVE feeds into vulnerability management with SLA tiers keyed to CVSS, KEV status, and exploit availability; track EPSS once FIRST.org scores this CVE rather than assuming a value.

References

• NVD — CVE-2026-75723: https://nvd.nist.gov/vuln/detail/CVE-2026-75723
• MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Adobe Security Bulletins and Advisories (vendor advisory channel for ACC fixes): https://helpx.adobe.com/security.html
• CISA Known Exploited Vulnerabilities Catalog (check for future addition of CVE-2026-75723): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on exploit-in-the-wild evidence: no threat actor campaign, exploitation activity, public PoC, exploit code, or Nuclei template has been identified for CVE-2026-75723 in the supplied data. EPSS has not yet been scored by FIRST.org; no EPSS value is asserted. Because no affected version range was published, vulnerability scanners and SBOM tooling cannot currently map this CVE to specific ACC builds — asset owners must confirm exposure directly with the vendor advisory when it becomes available.