CVE-2026-82004 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-82004 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-82004 is a critical Adobe Campaign Classic (ACC) vulnerability with a CVSS of 10.0. It is an OS command injection flaw that can allow an attacker to execute arbitrary code as the current user, with no user interaction required and scope changed. Even though it is not currently known to be exploited in the wild and is not in CISA KEV, this is the kind of issue that can turn a public-facing ACC instance into a full environment compromise very quickly.

If you run Adobe Campaign Classic for marketing automation, integrations, or customer workflows, treat this as an urgent patch-and-contain event. For solo developers and small teams, the biggest risk is not just the app itself, but any credentials, API keys, database access, or internal network reach the service account already has.

Immediate Action

  • Patch Adobe Campaign Classic immediately to the vendor-fixed release. If you do not yet know the fixed version, check the Adobe advisory and replace TODO_FIXED_VERSION with the first safe build.
  • Isolate the ACC host or container from the internet until patched: restrict inbound access to trusted IPs/VPN only, and block unnecessary outbound traffic.
  • Reduce privileges for the ACC service account now. Remove local admin/root rights, limit filesystem access, and rotate any secrets the service can read.
  • Rollback only if needed and only to a known-good, previously tested build. Do not roll back to an unpatched version after exposure.
  • Review logs for command execution indicators and unusual child processes spawned by the ACC service.
  • Read the vendor advisory: Adobe Security Bulletins (replace with the exact ACC advisory link if available).

Affected Versions

  • Adobe Campaign Classic@<= TODO_VULNERABLE_VERSION vulnerable; upgrade to TODO_FIXED_VERSION or later.
  • Adobe Campaign Classic v7.x vulnerable if running a build released before the fix; upgrade to the first patched release.
  • Adobe Campaign Classic v8.x vulnerable if running a build released before the fix; upgrade to the first patched release.
  • Any self-hosted or containerized ACC deployment using an affected build is vulnerable, regardless of platform.

Resolution Guide

Important: Adobe Campaign Classic is not typically managed through npm/pip/Maven like a library. The commands below are for your deployment tooling and dependencies around ACC, plus generic upgrade patterns you can adapt.

# Linux package update pattern (replace with your vendor package name)
sudo apt update
sudo apt install --only-upgrade adobe-campaign-classic=TODO_FIXED_VERSION

sudo yum update adobe-campaign-classic-TODO_FIXED_VERSION

# Docker: pin to a fixed image tag once Adobe publishes it
docker pull adobe/campaign-classic:TODO_FIXED_VERSION
docker stop acc
docker rm acc
docker run -d --name acc adobe/campaign-classic:TODO_FIXED_VERSION

# Java app dependency hygiene if ACC is wrapped by your own Java service
./mvnw versions:display-dependency-updates
./gradlew dependencyUpdates

# Python/JS ecosystem checks for surrounding automation or connectors
pip list --outdated
pipx list
npm outdated
yarn outdated
pnpm outdated

Hardening examples:

# Run the ACC service as a non-root user
sudo useradd --system --no-create-home accsvc
sudo chown -R accsvc:accsvc /opt/adobe/campaign

# Restrict outbound network access (example with ufw)
sudo ufw default deny outgoing
sudo ufw allow out to <required-db-ip> port 5432 proto tcp
sudo ufw allow out to <required-smtp-ip> port 25 proto tcp

# Disable or remove any feature that shells out to OS commands
# Example config idea: set vulnerable integration flags to false
OS_COMMAND_INTEGRATION_ENABLED=false
LEGACY_SCRIPT_EXECUTION=false

Minimal code fix pattern if your team has custom glue code that passes user input to shell commands:

// BAD: shell interpolation
exec("sh -c 'do-something " + userInput + "'");

// GOOD: strict allowlist + argument array
const allowed = new Set(["status", "sync", "report"]);
if (!allowed.has(userInput)) throw new Error("Invalid command");
execFile("/usr/local/bin/do-something", [userInput]);

Detection & Verification

Check your version:

# Locate installed version
grep -Rni "Campaign Classic\|ACC\|version" /opt/adobe/campaign 2>/dev/null | head
/opt/adobe/campaign/bin/campaign --version 2>/dev/null || true

Look for risky command execution paths:

# Search for shell-outs in scripts/configs
grep -RniE "system\(|exec\(|popen\(|sh -c|cmd /c|Runtime\.getRuntime\(\)\.exec" /opt/adobe/campaign 2>/dev/null

Check for suspicious child processes spawned by the ACC service:

ps -ef | grep -E "campaign|acc" | grep -v grep
sudo journalctl -u adobe-campaign --since "24 hours ago"
sudo ausearch -x sh -x bash -x cmd -x powershell --start today 2>/dev/null

Verify the fix:

# Confirm the patched version is installed
/opt/adobe/campaign/bin/campaign --version

# Re-run dependency and config checks
grep -RniE "OS_COMMAND_INTEGRATION_ENABLED|LEGACY_SCRIPT_EXECUTION" /opt/adobe/campaign/etc

Risk and Impact

This vulnerability can let an attacker run arbitrary commands in the context of the ACC service account, which may be enough to steal credentials, read customer data, tamper with workflows, or pivot into internal systems. Because the flaw requires no user interaction and changes scope, a single exposed instance can become a foothold for broader compromise. For small teams, the blast radius often includes databases, SMTP credentials, cloud tokens, and any shared secrets stored on the host.

Even without known active exploitation, a CVSS 10 command injection in a customer-facing platform should be treated as an emergency: patch first, then verify, then hunt for abuse.

Keep reading