#202020

Adobe Security Bulletin

Last updated on Sep 22, 2026

Security update available for Adobe Campaign Classic | APSB26-142

Bulletin ID

Date published

Priority

APSB26-142

September 8, 2026

style

grid width 12

Summary

Adobe has released a security update for Adobe Campaign Classic. This update addresses critical vulnerabilities that could result in arbitrary code execution, security feature bypass, arbitrary file system read, and application denial-of-service.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected versions

Product

Affected version

Platform

Adobe Campaign Classic

ACC v7: 7.4.4 build 9401 and earlier

Windows, Linux

style

grid width 12

Solution

Adobe categorizes these updates with the following priority rating and recommends users update their installation to the newest version:

Product

Updated version

Platform

Priority rating

Availability

Adobe Campaign Classic

ACC v7 7.4.4 build 9402

Windows, Linux

Release Notes

style

grid width 12

Note

This security bulletin applies to fully on-premise deployments of Adobe Campaign Classic and the on-premise components of hybrid deployments. Adobe-hosted instances have already been remediated and require no customer action.

Due to the deployment model for Adobe-hosted environments, the applicable security fixes were deployed without incrementing the customer-visible Campaign build number. As a result, some Adobe-hosted instances may continue to report build 9401 even though the applicable security fixes have already been deployed.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Vulnerability Details

CVE-2026-82004

Vulnerability category: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-73369

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-84412

CVE-2026-89275

CVE-2026-75723

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-75699

CVE-2026-75703

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Application denial-of-service
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-75721

CVE-2026-89276

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

CVE-2026-82008

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-82003

CVE-2026-83660

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

CVE-2026-82010

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-82013

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-82443

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Arbitrary file system read
Severity: Critical
CVSS base score: 9.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CVE-2026-75728

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE-2026-82011

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

CVE-2026-82009

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Revisions

September 22, 2026: Added CVE-2026-73369, CVE-2026-84412, CVE-2026-89275, CVE-2026-75723, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-89276, CVE-2026-82008, CVE-2026-82003, CVE-2026-83660, CVE-2026-82010, CVE-2026-82013, CVE-2026-82443, CVE-2026-75728, CVE-2026-82011, and CVE-2026-82009.

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

Home
Security
Bulletins
APSB26-142

CardTitle

APSB26-142

CardDescription

Priority 1 Security update

CardImage

Created

2026-09-08