CVE-2026-84412

Executive Summary

CVE-2026-84412 is an improper control of generation of code ("code injection") vulnerability in Adobe Campaign Classic (ACC) that permits unauthenticated, network-reachable arbitrary code execution in the context of the current user. The CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting no privileges or user interaction required and a scope change indicating impact beyond the vulnerable component. No public proof-of-concept, Nuclei template, or exploit code has been observed, the issue is not listed in CISA KEV, and no vendor patch or fixed version has been identified from any tracked source — patch confidence is 0/4.

Technical Analysis

The NVD description classifies this issue under CWE-94, Improper Control of Generation of Code ('Code Injection'). The affected product is Adobe Campaign Classic, an enterprise marketing automation platform that typically exposes web-accessible consoles and server-side execution components. The vulnerability allows an attacker to inject and cause execution of code such that it runs "in the context of the current user," and the CVSS vector's scope-changed (S:C) metric indicates the exploited component can affect resources beyond its own security authority — a common characteristic when injected code executes with the privileges of a service, application pool, or application account rather than being confined to a single trust boundary.

The attack surface is network-exposed (AV:N) and requires no authentication (PR:N) and no user interaction (UI:N), meaning the vulnerable code path is reachable by an unauthenticated remote client. The precise injectable parameter, endpoint, class, or method is not disclosed in the available data, and no CVE record supplied here names a specific file path, API route, or function. Accordingly, this report does not assert implementation-level specifics beyond the vulnerability class.

At the class level, code injection in a server-side marketing platform typically arises where attacker-supplied input is incorporated into a dynamically evaluated or generated code construct — for example, template evaluation, scripting engine invocation, expression parsing, or dynamic query/command construction — without adequate neutralization. Success results in arbitrary code execution under the identity of the application or service account processing the request. Because the confidentiality, integrity, and availability impacts are all rated High and scope is changed, a successful exploit can be expected to compromise data, mutate application and business logic, and disrupt service availability, while potentially pivoting to resources the vulnerable component was not intended to control.

No affected version range, CPE configuration, or OSV package mapping is available in the provided data. Absence of a published fixed version means defenders cannot rely on version-diff patching and must treat all internet-facing ACC deployments as potentially affected until Adobe publishes an advisory or the CNA supplies a version matrix.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-84412. The attack chain below is inferred strictly from the vulnerability class (CWE-94) and the CVSS vector; no specific function names, endpoints, file paths, or parameters are asserted because none appear in the source data.

1. Reconnaissance / target identification. An attacker enumerates internet-facing Adobe Campaign Classic instances using passive and active techniques — banner and certificate inspection, HTML title/content fingerprinting (see SHODAN_DORKS in METADATA), and known ACC hostname/path conventions. Because the vector is AV:N/PR:N/UI:N, no credential acquisition or victim luring is required; any reachable, unauthenticated code path that processes attacker input is a candidate entry point. No specific path is claimed here.

2. Triggering the code injection flaw. The attacker submits crafted input to the vulnerable request handling path. By definition of CWE-94, the application incorporates this input into a dynamically generated or evaluated code construct without sufficient control over what code is produced. The NVD description does not disclose which input field or endpoint is affected, so the exact trigger is unknown; the class-level requirement is simply that the attacker can reach the affected code generation logic over the network without authenticating.

3. Payload / execution method. At the class level, the attacker supplies content that, once incorporated into the generated/evaluated construct, is executed by the server-side runtime rather than treated as inert data. The result is arbitrary code execution "in the context of the current user" — i.e., under the identity of the account executing the ACC server-side component. No specific payload syntax, language, or interpreter is asserted, as the source data does not identify it.

4. Post-exploitation impact. Given C:H/I:H/A:H and S:C, the attacker can expect to read and exfiltrate sensitive data, modify application state and business logic, and degrade or deny availability. The scope change implies the compromised component can be leveraged to affect systems or data outside its own security boundary, supporting lateral movement or privilege escalation relative to the exploited trust boundary, depending on the privileges of the execution context.

Because the flaw requires neither authentication nor user interaction and is network reachable, exploitation is low-complexity (AC:L) for any attacker who can identify and reach a vulnerable, unauthenticated code path. This combination is what drives the maximum base score of 10.0.

Impact Assessment

The CVSS 3.1 base score is 10.0 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Subscores indicate:

• Attack Vector Network (AV:N): exploitable remotely across the internet, not limited to adjacent or local access.
• Attack Complexity Low (AC:L): no specialized conditions or race windows are required; repeatable exploitation is assumed.
• Privileges Required None (PR:N): no account or authentication is needed.
• User Interaction None (UI:N): no victim action is required; exploitation is server-side and unattended.
• Scope Changed (S:C): impact extends beyond the vulnerable component's own security authority.
• Confidentiality/Integrity/Availability High (C:H/I:H/A:H): total loss of confidentiality, integrity, and availability is expected within the impacted context.

Business impact for an ACC deployment is substantial. Campaign Classic holds customer profiles, segmentation logic, send lists, and integration credentials, and it typically connects to CRM, data warehouses, and email/SMS delivery infrastructure. Arbitrary code execution under the application's service identity could expose large volumes of personal data (regulatory exposure under GDPR and similar regimes), allow tampering with or suppression of campaign sends, enable injection of malicious content into outbound communications, and provide a foothold for lateral movement into connected systems. The scope-change metric indicates blast radius is not limited to the ACC component alone. Because availability is rated High, denial-of-service or destructive actions against the platform are also in scope.

Blast radius: any internet-reachable, unauthenticated ACC code path is in scope while no fixed version is known. Asset owners should treat exposed ACC instances as fully compromised-capable attack surface until a vendor advisory provides version and mitigation detail. The absence of an EPSS score (not yet scored by FIRST.org), absence from CISA KEV, and absence of any public exploit indicate that, as of the data provided, exploitation has not been publicly confirmed — this is not evidence that the flaw is unexploitable.

Detection Guidance

Detection content below targets the vulnerability class (unauthenticated code injection leading to server-side code execution in Adobe Campaign Classic) and must be tuned to the environment. Because no specific endpoint, parameter, or payload string is disclosed in the source data, these rules necessarily use behavioral and heuristic indicators (suspicious process lineage, anomalous outbound connections from the ACC server, injection-metacharacter patterns in HTTP requests to ACC). They will require localization against actual ACC logging and deployment paths.

Sigma Rule

title: Potential Adobe Campaign Classic Code Injection - Suspicious Server-Side Process Spawn
id: 7f3c9a02-8b1e-4d6a-9f21-acde84412026
status: experimental
description: Detects suspicious child processes spawned by web/application server processes hosting Adobe Campaign Classic, consistent with arbitrary code execution following CWE-94 code injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84412
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.execution
  - cve.2026.84412
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\tomcat.exe'
      - '\httpd.exe'
      - '\w3wp.exe'
  selection_susp_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\certutil.exe'
  selection_cmdline:
    CommandLine|contains:
      - '-enc'
      - 'FromBase64String'
      - 'Invoke-Expression'
      - 'IEX('
      - 'DownloadString'
      - 'curl '
      - 'wget '
  condition: selection_parent and (selection_susp_child or selection_cmdline)
falsepositives:
  - Legitimate administrative scripts executed by the application server account
  - Scheduled maintenance tasks launched from the ACC host
level: high

YARA Rule

rule CVE_2026_84412_ACC_Code_Injection_Generic
{
    meta:
        description = "Generic heuristic detection for Adobe Campaign Classic code injection artifacts (CVE-2026-84412). Class-level indicators only; no specific exploit signature available."
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84412"
        cve = "CVE-2026-84412"
        cwe = "CWE-94"

    strings:
        $acc = "Adobe Campaign" ascii wide nocase
        $i1  = "Runtime.getRuntime().exec" ascii wide
        $i2  = "ProcessBuilder" ascii wide
        $i3  = "ScriptEngine" ascii wide
        $i4  = "eval(" ascii wide
        $i5  = "Class.forName" ascii wide
        $b64 = "Base64" ascii wide

    condition:
        uint16(0) == 0x4D5A or uint32(0) == 0x464C457F
        and $acc
        and 2 of ($i*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-84412 Adobe Campaign Classic Potential Code Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Adobe Campaign"; nocase; http.request_body; content:"|24 7b|"; http.request_body; content:"|23 7b|"; http.request_body; content:"Runtime"; nocase; http.request_body; content:"exec"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:web-application-attack; reference:cve,2026-84412; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84412; sid:2026844120; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("java", "tomcat", "httpd", "w3wp") and
  (
    process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "bash", "sh") or
    process.command_line : ("*-enc*", "*FromBase64String*", "*Invoke-Expression*", "*IEX(*", "*system(*", "*exec(*")
  )

Splunk SPL Query

index=web OR index=proxy OR index=windows
(
  (sourcetype=access_combined OR sourcetype=stream:http)
  (uri_path="*" AND http_method=POST AND (form_data="*Runtime*" OR form_data="*eval(*" OR form_data="*ProcessBuilder*" OR form_data="*${*}" OR form_data="*#{*}"))
)
OR
(
  sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1
  (ParentImage="*\\java.exe" OR ParentImage="*\\tomcat*" OR ParentImage="*\\w3wp.exe")
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\mshta.exe" OR Image="*\\certutil.exe")
)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, Image, CommandLine
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="adobe_campaign,cve-2026-84412,web,">
  <rule id="100412" level="12">
    <if_sid>31533</if_sid>
    <decoded_as>web-accesslog</decoded_as>
    <url>\.jsp|\.do|/nl/|/r/</url>
    <match>Runtime|ProcessBuilder|eval\(|getRuntime</match>
    <description>CVE-2026-84412: Possible Adobe Campaign Classic code injection attempt in HTTP request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_84412,attack,</group>
  </rule>

  <rule id="100413" level="13">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">java.exe|w3wp.exe|tomcat</field>
    <field name="win.eventdata.image">cmd.exe|powershell.exe|mshta.exe</field>
    <description>CVE-2026-84412: Suspicious child process spawned by web/app server (possible ACC code execution)</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_84412,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, workaround, or affected-version matrix was available from any tracked source at the time of writing. The guidance below is class-based and must be validated against Adobe's advisory once published.

1. Immediate mitigations

• Remove or restrict internet exposure of Adobe Campaign Classic consoles and server endpoints. Place ACC behind an authenticated reverse proxy or VPN and allow only known administrative source IPs.
• Enforce authentication and network ACLs on all previously unauthenticated code paths; the CVSS vector shows PR:N and UI:N, so any unauthenticated reachable path is high risk.
• Deploy virtual patching at the WAF/reverse proxy layer for CWE-94 injection patterns (see Detection Guidance) as a compensating control, understanding that WAF is bypassable and not a fix.
• Run the ACC application and its web/application server components under least-privilege, low-integrity accounts with no local admin rights and no unnecessary outbound network access, to limit the scope-change impact of any successful code execution.
• Apply strict egress filtering from ACC hosts; alert on new outbound connections to unfamiliar destinations.
• Retain and centralize HTTP access logs and process-creation telemetry from all ACC hosts for retrospective hunting.

2. Patch/upgrade steps

• Monitor Adobe's security bulletin channel and the NVD entry for CVE-2026-84412 for the official fixed build and affected-version matrix; no patch reference is currently available.
• When a fix ships, inventory all ACC instances and dependencies, stage the update in a non-production environment, verify the previously exposed code path is closed, then roll out with a documented rollback plan.
• Because no affected version range is known, treat every internet-facing ACC deployment as vulnerable until version applicability is confirmed.
• There is no evidence this CVE is in CISA KEV; monitor KEV and vendor advisories for changes in status.

3. Long-term hardening

• Adopt an input-handling standard that eliminates dynamic code generation/evaluation from request-processing paths in favor of parameterized, non-evaluating APIs, directly addressing CWE-94.
• Maintain a complete software bill of materials and asset inventory for ACC and supporting runtimes to enable fast impact assessment when advisories land.
• Operate a routine patch-management SLA for internet-facing marketing platforms, and continuously validate exposure with authenticated and unauthenticated external scans.
• Implement centralized logging, detection content (see Detection Guidance), and periodic purple-team validation of unauthenticated attack paths.
• Segment ACC from delivery infrastructure, CRM, and data warehouses to constrain lateral movement.

References

• NVD — CVE-2026-84412: https://nvd.nist.gov/vuln/detail/CVE-2026-84412
• MITRE CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Adobe Security Bulletins and Advisories (check for the ACC advisory corresponding to CVE-2026-84412): https://helpx.adobe.com/security.html
• CISA Known Exploited Vulnerabilities Catalog (monitor for CVE-2026-84412 status; not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template was identified. No evidence of in-the-wild exploitation or attributed threat-actor campaigns was available in the provided data; this CVE is not currently listed in CISA KEV, and EPSS has not yet been scored by FIRST.org.