CVE-2026-104351 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-104351 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-104351 is a critical Adobe Campaign Classic (ACC) code injection flaw with a CVSS 9.9. A low-privileged attacker can trigger arbitrary code execution without user interaction, and the vulnerability has changed scope, which increases the chance of broader compromise inside your environment.

Even though this issue is not currently in CISA KEV and there are no confirmed active exploitation reports, solo developers and small teams should treat it as an emergency if ACC is exposed to untrusted users, automation, or internet-facing workflows. If you run ACC in production, assume a successful exploit could lead to full takeover of the application context and pivoting into adjacent systems.

Immediate Action

  • Patch immediately using the vendor’s fixed release as soon as it is available. If you do not yet have the exact fixed version, track the Adobe security advisory and apply the first patched build listed there.
  • Isolate ACC from the internet and from non-essential internal networks until patched. Restrict access to admin and application endpoints to VPN, bastion hosts, or a narrow allowlist.
  • Disable or limit low-privilege accounts that can reach the affected code path. Remove unused service accounts, API users, and delegated roles.
  • Take a rollback-ready backup of the application, configs, and database before upgrading. If the patch breaks workflows, revert quickly rather than leaving the service exposed.
  • Review logs now for unusual request patterns, unexpected script execution, child processes, or outbound connections from the ACC host.
  • Temporarily reduce blast radius by running ACC under the least-privileged service account possible and blocking outbound internet access except what is required for operations.

Affected Versions

  • Adobe Campaign Classic (ACC) affected versions: TODO exact vulnerable versions from Adobe advisory
  • Safe version: TODO fixed version or later
  • Safe version: any vendor-recommended patched build listed in the Adobe advisory

Note: If your deployment uses bundled components, containers, or custom images, treat the entire stack as vulnerable until the ACC application layer is confirmed patched.

Resolution Guide

Primary fix: upgrade ACC to the vendor-patched release. Use the exact version from Adobe’s advisory.

# Linux package-based install (example placeholders)
sudo apt-get update
sudo apt-get install --only-upgrade adobe-campaign-classic=TODO_FIXED_VERSION

sudo yum update adobe-campaign-classic-TODO_FIXED_VERSION

# Docker image update (replace with vendor-published tag)
docker pull adobe/acc:TODO_FIXED_TAG
docker stop acc
docker rm acc
docker run -d --name acc adobe/acc:TODO_FIXED_TAG

# If ACC is deployed via compose
docker compose pull
docker compose up -d

Hardening while you patch:

# Example: restrict outbound traffic from the ACC host
sudo ufw default deny outgoing
sudo ufw allow out 53,80,443/tcp
sudo ufw allow from TODO_ADMIN_IP to any port TODO_ACC_ADMIN_PORT proto tcp

# Example: disable a risky feature flag or module if Adobe documents one
export ACC_DISABLE_TODO_FEATURE=1
# or remove the module from the service config

Minimal code/config fix pattern: if your deployment includes custom scripts or extensions that pass user input into shell commands, remove that behavior immediately.

// Bad: command injection risk
exec(`do-task ${userInput}`);

// Better: strict allowlist
const allowed = new Set(['daily', 'weekly']);
if (!allowed.has(userInput)) throw new Error('invalid input');
execFile('do-task', [userInput]);

Java ecosystem commands if ACC is wrapped in a Java service or plugin:

# Maven
mvn versions:use-latest-releases

# Gradle
./gradlew dependencyUpdates

# Pin a fixed dependency version
implementation("group:artifact:TODO_FIXED_VERSION")

Python ecosystem commands if automation around ACC uses Python packages:

pip list --outdated
pip install --upgrade package==TODO_FIXED_VERSION
pipx upgrade package

JavaScript ecosystem commands if your ACC integration uses Node tooling:

npm audit
npm i package@TODO_FIXED_VERSION
yarn add package@TODO_FIXED_VERSION
pnpm add package@TODO_FIXED_VERSION

Detection & Verification

Check the installed ACC version:

# Common examples; adjust to your install path
/opt/adobe/campaign/bin/campaign -version
strings /opt/adobe/campaign/bin/* | grep -i "Campaign Classic"

Search for vulnerable exposure points and suspicious behavior:

# Look for recent process launches and shell usage
ps auxf
journalctl -u acc --since "24 hours ago" | grep -Ei "exec|spawn|shell|curl|wget"

# Look for unexpected outbound connections
ss -tpn
lsof -i -P -n | grep ESTABLISHED

Audit logs for abnormal requests or injection markers:

grep -RniE "(\$\(|;|&&|\||`|<script>|eval\()" /var/log/adobe/ /opt/adobe/campaign/logs/

Verify the fix:

# Confirm the patched version is installed
/opt/adobe/campaign/bin/campaign -version

# Confirm package manager state
apt-cache policy adobe-campaign-classic
rpm -q adobe-campaign-classic

# Confirm no vulnerable container tag remains
docker images | grep -i acc

If Adobe publishes a security bulletin with a build number, compare it directly against your deployed version and document the result in your change record.

Risk and Impact

This flaw can let a low-privileged attacker run arbitrary code as the ACC service user, which may be enough to steal credentials, alter campaigns, access customer data, or plant persistence. Because the scope is changed, the impact can extend beyond the initial component and affect other services or data the ACC host can reach.

For small teams, the biggest danger is not just application compromise but the speed of lateral movement: a single exposed ACC instance can become a foothold into databases, mail infrastructure, secrets stores, and CI/CD systems. Patch first, then investigate for signs of abuse.

Keep reading