Adobe Security Bulletin

Last updated on Sep 22, 2026

Security update available for Adobe Campaign Classic | APSB26-142

Bulletin ID

Date published

Priority

APSB26-142

September 8, 2026

1

style

grid width 12

Summary

Adobe has released a security update for Adobe Campaign Classic. This update addresses critical vulnerabilities that could result in arbitrary code execution, security feature bypass, arbitrary file system read, and application denial-of-service.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected versions

Product

Affected version

Platform

Adobe Campaign Classic

ACC v7: 7.4.4 build 9401 and earlier

Windows, Linux

style

grid width 12

Solution

Adobe categorizes these updates with the following priority rating and recommends users update their installation to the newest version:

Product

Updated version

Platform

Priority rating

Availability

Adobe Campaign Classic

ACC v7 7.4.4 build 9402

Windows, Linux

1

style

grid width 12

Note

This security bulletin applies to fully on-premise deployments of Adobe Campaign Classic and the on-premise components of hybrid deployments. Adobe-hosted instances have already been remediated and require no customer action.

Due to the deployment model for Adobe-hosted environments, the applicable security fixes were deployed without incrementing the customer-visible Campaign build number. As a result, some Adobe-hosted instances may continue to report build 9401 even though the applicable security fixes have already been deployed.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Vulnerability Details

CVE-2026-82004

Vulnerability category: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-73369

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-84412

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-89275

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-75723

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-75699

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-75703

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Application denial-of-service
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-75721

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-89276

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

CVE-2026-82008

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-82003

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-83660

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

CVE-2026-82010

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-82013

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-82443

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Arbitrary file system read
Severity: Critical
CVSS base score: 9.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

CVE-2026-75728

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVE-2026-82011

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

CVE-2026-82009

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Revisions

September 22, 2026: Added CVE-2026-73369, CVE-2026-84412, CVE-2026-89275, CVE-2026-75723, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-89276, CVE-2026-82008, CVE-2026-82003, CVE-2026-83660, CVE-2026-82010, CVE-2026-82013, CVE-2026-82443, CVE-2026-75728, CVE-2026-82011, and CVE-2026-82009.

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle

APSB26-142

CardDescription

Priority 1 Security update

CardImage

Adobe

Created

2026-09-08

Tags

caas:content-type/documentation,caas:trust-center/security-bulletin,caas:products/adobe-campaign

PrimaryTag

caas:content-type/article

Details

caas:mnemonics/adobe-campaign

Arbitrary

search: CVE-2026-82004 CVE-2026-73369 CVE-2026-84412 CVE-2026-89275 CVE-2026-75723 CVE-2026-75699 CVE-2026-75703 CVE-2026-75721 CVE-2026-89276 CVE-2026-82008 CVE-2026-82003 CVE-2026-83660 CVE-2026-82010 CVE-2026-82013 CVE-2026-82443 CVE-2026-75728 CVE-2026-82011 CVE-2026-82009