CVE-2026-89275

Executive Summary

CVE-2026-89275 is a critical code injection vulnerability (CWE-94) in Adobe Campaign Classic (ACC) that permits unauthenticated, remote arbitrary code execution in the context of the current user. With a CVSS v3.1 base score of 10.0 and a Scope-Changed vector, the flaw allows an attacker to escape the vulnerable component's security boundary and impact resources beyond its original authorization scope. No public proof-of-concept, Nuclei template, or exploit code is currently available, and the vendor/product metadata and affected version ranges are not specified in the provided intelligence, meaning organizations running Adobe Campaign Classic must treat all deployed instances as potentially at risk until Adobe publishes an advisory.

Technical Analysis

The vulnerability is classified under CWE-94: Improper Control of Generation of Code, commonly referred to as Code Injection. This weakness class occurs when an application constructs code — or a code-like construct — using externally influenced input without adequately neutralizing special elements, delimiters, or control characters. Unlike injection flaws that remain confined to a data context (for example SQL injection within a query engine), code injection flaws result in attacker-controlled instructions being interpreted and executed by a runtime, interpreter, or templating engine. That distinction is why the CVSS vector specifies Scope is Changed (S:C): successful exploitation allows the attacker to affect components, data, or privileges outside the security authority of the vulnerable ACC component.

The NVD description states the impact precisely: arbitrary code execution "in the context of the current user." This framing indicates that the injected code inherits the privileges and access rights of the process or account that handles the vulnerable input path — not necessarily administrative or system-level privileges. Therefore, the practical severity of any individual compromise depends on the privilege level under which the ACC application service or component executes. In many enterprise deployments, application services run under dedicated service accounts with substantial filesystem, network, and database access, so even a non-root context can yield significant lateral movement potential.

Critical attack-surface characteristics are derivable directly from the CVSS vector:

• Attack Vector: Network (AV:N) — the vulnerable component is reachable over a network interface; no local or adjacent access is needed.
• Attack Complexity: Low (AC:L) — no special conditions, race windows, or attacker-controlled prerequisites beyond normal reachability are required.
• Privileges Required: None (PR:N) — the attacker does not need any authenticated account or role on the target.
• User Interaction: None (UI:N) — per the NVD description, "Exploitation of this issue does not require user interaction." No victim must click a link, open a file, or trigger a workflow.

The combination of AV:N/AC:L/PR:N/UI:N with Scope Change and High impact across Confidentiality, Integrity, and Availability represents the maximum possible base score (10.0) under CVSS v3.1. This means the flaw is remotely reachable, trivially triggerable, requires no credentials or victim action, and can fully compromise confidentiality, integrity, and availability while crossing a security boundary.

No specific function names, class names, URL endpoints, API paths, file paths, or parameter names are provided in the CNA title or NVD description. Consequently, the exact injection point within the Adobe Campaign Classic codebase cannot be identified from the available intelligence. The mechanism, at the vulnerability-class level, is that some externally reachable input is incorporated into a dynamically generated or dynamically evaluated code construct (for example a template, script, expression, or serialized payload) without adequate sanitization or allow-listing, allowing the attacker's input to be interpreted as executable logic.

It should be noted explicitly that no affected version range has been published. Adobe Campaign Classic is delivered both as an on-premise installable product and, in some editions, as a managed/hosted service. Enterprises running self-managed ACC instances carry the full remediation burden themselves and should assume exposure until a vendor advisory and fixed build are released.

Exploitation Scenarios

No public proof-of-concept is available for CVE-2026-89275. The attack chain below is inferred strictly from the NVD description and the CVSS vector; no specific implementation details, endpoints, or parameter names are invented.

1. Reconnaissance / target identification. Because the vector is AV:N with PR:N, the attacker requires only network reachability to the ACC component that processes the vulnerable input. An adversary would enumerate internet- or intranet-exposed Adobe Campaign Classic instances, fingerprint the ACC deployment, and identify interfaces that accept untrusted input without prior authentication. Because UI:N, no social engineering or victim participation is necessary — the attacker can trigger the flaw entirely remotely.

2. Triggering the flaw class. The attacker submits crafted input to the vulnerable interface. Because the root cause is CWE-94, the input is not neutralized before being incorporated into a code-generation or code-evaluation path, so it is interpreted as executable instructions rather than inert data. The NVD description confirms the component is Adobe Campaign Classic and the vulnerability class is Code Injection, but does not specify which interface carries the input; therefore the exact request structure cannot be described without fabrication. At the class level, any unauthenticated reachable feature that performs dynamic code or template generation is a candidate trigger point.

3. Payload / execution. The injected code executes "in the context of the current user" — that is, with the privileges of the ACC process or service account handling the request. The attacker does not gain higher privileges directly from this step, but achieves code execution within the application's trust boundary. The payload's objective is to run attacker-chosen logic server-side rather than client-side.

4. Post-exploitation impact. Because Scope is Changed, the attacker is not confined to the vulnerable component: the compromise can propagate to other applications, data stores, or accounts that the ACC component trusts or communicates with. With High impacts to Confidentiality (exfiltration of campaign data, recipient lists, credentials, or integrated marketing data), Integrity (modification of campaigns, templates, or stored records), and Availability (disruption of the marketing platform or its downstream integrations), the blast radius extends well beyond the single service.

Impact Assessment

CVE-2026-89275 carries a CVSS v3.1 base score of 10.0, the maximum possible. Each metric contributes to that severity:

• AV:N and PR:N mean the vulnerable component is exposed to unauthenticated attackers across a network. Any ACC instance reachable by an adversary — including partner integrations, marketing agency access, or internet-facing consoles — is a candidate target.
• AC:L and UI:N mean exploitation requires no complex preconditions and no victim action. Defenders cannot rely on user education or workflow gating to reduce the attack window.
• S:C indicates the attack crosses a privilege/security boundary. The attacker's reach is not limited to the vulnerable ACC component; downstream systems that the component can access or authenticate to may also be affected.
• C:H, I:H, A:H indicate total loss of confidentiality, integrity, and availability for the affected scope.

Business impact for an Adobe Campaign Classic deployment is significant. ACC is a marketing automation and campaign management platform that typically stores or processes large volumes of customer data: recipient lists, segmentation rules, behavioral data, and connected CRM/marketing integrations. A code execution foothold in this system can lead to exfiltration of regulated personal data (raising GDPR, CCPA, and similar compliance exposure), tampering with outbound campaigns, and potential lateral movement into connected mail infrastructure, databases, and analytics tools. Because Scope is Changed, the enterprise should assume the trust relationships between ACC and its connected systems can be abused.

Affected systems: any Adobe Campaign Classic instance matched to the (currently unpublished) vulnerable version range. Because no version range or OSV package data is available, defenders cannot scope precisely by version and should inventory all ACC deployments and treat them as exposed. Blast radius: the ACC instance itself, its database backends, integrated CRM/ESP systems, and any credentials or API keys the ACC service holds.

Detection Guidance

Because no PoC or exploit signatures are available, the following rules are heuristic detection constructs keyed to the vulnerability class (CWE-94 code injection into a Java-based enterprise marketing platform such as Adobe Campaign Classic). They detect anomalous request patterns and post-exploitation behavior associated with unauthenticated code injection; they should be tuned to each environment and are not signature-perfect for an unpublished flaw.

Sigma Rule

title: Potential Adobe Campaign Classic Unauthenticated Code Injection Activity
id: 7f3c1a92-5b4e-4d21-9c88-acc94cve2026
status: experimental
description: Detects anomalous web requests and child process behavior consistent with code injection (CWE-94) against unauthenticated Adobe Campaign Classic interfaces.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-89275
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_path:
    c-uri|contains:
      - '/nl/jsp/'
      - '/r/test'
      - '/xtk/'
  selection_payload:
    c-uri|contains:
      - 'Runtime'
      - 'exec('
      - '${'
      - 'ProcessBuilder'
      - 'getRuntime'
      - '<%'
  condition: selection_path and selection_payload
falsepositives:
  - Legitimate application features that construct dynamic templates
level: high
tags:
  - attack.t1190
  - cve.2026.89275

YARA Rule

rule CVE_2026_89275_Adobe_Campaign_Code_Injection
{
    meta:
        description = "Detects code-injection indicators targeting Adobe Campaign Classic (CVE-2026-89275)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-89275"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $rt   = "getRuntime" ascii wide nocase
        $exec = ".exec(" ascii wide nocase
        $pb   = "ProcessBuilder" ascii wide nocase
        $el   = "${" ascii wide
        $jsp  = "<%=" ascii wide

    condition:
        uint16(0) == 0x3C25 or
        (2 of ($rt, $exec, $pb) and 1 of ($el, $jsp))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-89275 Adobe Campaign Classic Code Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"nl/jsp"; http.request_body; content:"getRuntime"|20 20|content:"exec"; nocase; threshold:type both, track by_src, count 3, seconds 60; classtype:web-application-attack; reference:cve,2026-89275; sid:2026889275; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [network where http.request.method == "POST" and
     stringContains(http.request.path, "nl/jsp") and
     stringContains(http.request.body, "Runtime")]
  [process where event.type == "start" and
     process.parent.name in ("java", "jrun", "tomcat", "nlserver") and
     process.name in ("sh","bash","cmd.exe","powershell.exe","curl","wget")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=acc_log
| eval body_lower=lower(coalesce(request_body, uri, ""))
| where match(body_lower, "(getruntime|processbuilder|\.exec\(|\$\{)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-89275,">
  <rule id="100275" level="12">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <url>nl/jsp</url>
    <match>getRuntime|ProcessBuilder|\.exec\(|\$\{</match>
    <description>CVE-2026-89275: Possible unauthenticated code injection attempt against Adobe Campaign Classic</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_89275,pci_dss_6.5,gdpr_iv_35.7.d,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence is available from any tracked source, the vendor fix field is N/A, and no affected-version range has been published. Until Adobe releases an advisory and fixed build, treat every Adobe Campaign Classic deployment as potentially exploitable.

1. Immediate mitigations:

   • Network-segment and firewall all Adobe Campaign Classic administrative and application interfaces. Remove any internet-facing exposure. Restrict access to trusted management networks only; this is the single most effective control given AV:N/PR:N exploitation.
   • Enforce authentication at every reverse proxy or load balancer in front of ACC so that no unauthenticated request reaches the ACC application tier, reducing the PR:N exposure.
   • Deploy WAF rules that flag or block requests containing code-execution indicators (Runtime, ProcessBuilder, .exec(, template delimiters) targeting ACC paths. Treat these as compensating controls, not fixes.
   • Monitor ACC logs and web access logs continuously for anomalous POST bodies and for unexpected child processes spawned by the ACC service account.

2. Patch / upgrade steps:

   • Monitor Adobe's security bulletin portal and the Adobe Product Security Advisory feed for the CVE-2026-89275 advisory.
   • Add the CVE to your vulnerability management platform and set a critical SLA. Because no version range exists, inventory all ACC instances and map their build versions now so patch applicability can be determined instantly when Adobe publishes.
   • When a fixed build is available, stage it in a non-production ACC environment, validate campaign workflows, then deploy to production during a maintenance window with rollback prepared.
   • For Adobe-managed/hosted ACC editions, open a support case referencing the CVE and confirm the hosted instance timeline.

3. Long-term hardening:

   • Run ACC service accounts with least privilege; restrict filesystem write access, outbound network egress, and database permissions so a code execution foothold cannot easily escalate or move laterally (directly relevant given Scope is Changed).
   • Adopt egress filtering and application allow-listing so that unexpected outbound connections from an ACC host are blocked and logged.
   • Rotate any credentials, API keys, or integration secrets held by ACC instances that may have been reachable during the exposure window.
   • Keep ACC and its underlying Java runtime, database, and OS components current, and include ACC in a regular, authenticated vulnerability scanning program.

References

• NVD — CVE-2026-89275: https://nvd.nist.gov/vuln/detail/CVE-2026-89275
• CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• Adobe Product Security Bulletins / Advisories portal: https://helpx.adobe.com/security.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-89275 not currently listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: CISA KEV status is NO; no public PoC, Nuclei template, or exploit code is available; no threat actor campaign is known or claimed in the provided data. Exploitation status should be re-validated against Adobe and CISA advisories as new intelligence emerges, particularly once an affected-version range and fixed build are published.