---
id: "CVE-2026-104353"
kind: "vulnerability"
aliases: ["CVE-2026-104353"]
title: "Adobe Campaign Classic: OS command injection lets low-privilege users run code"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Adobe Campaign Classic", "fixed": ["7.4.4 build 9403"], "affected": "ACC v7 <= 7.4.4 build 9402", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-campaign-classic", "authenticated", "on-premise", "os-command-injection", "rce", "self-hosted", "vendor"]
not_affected_if: ["adobe-hosted", "managed-hosting"]
published_at: "2026-10-27T17:16:55+00:00"
first_seen_at: "2026-10-27T17:32:44+00:00"
updated_at: "2026-10-27T17:38:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104353", "first_seen_at": "2026-10-27T17:32:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T17:38:24+00:00"}]
---

# Adobe Campaign Classic: OS command injection lets low-privilege users run code

Adobe Campaign Classic has an OS command injection flaw in which special characters are not neutralized before being passed to a system command. A low-privileged attacker can run arbitrary code in the context of the current user, without user interaction.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Campaign Classic affected ACC v7 <= 7.4.4 build 9402 fixed 7.4.4 build 9403

## How to check

Check your Campaign Classic build number (console Help > About, or server build). 7.4.4 build 9402 and earlier is affected; build 9403 or later is fixed.

## Fix

Update Adobe Campaign Classic v7 to 7.4.4 build 9403 or later (Windows, Linux), then restart the Campaign server (nlserver) to load the build; the fix is active by default once restarted.

## Timeline

- 2026-10-27T17:32:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104353
- 2026-10-27T17:38:24+00:00 analyst — Adobe APSB26-162 (Oct 27 2026, priority 2) lists this CVE: CWE-78, CVSS 9.9 AV:N/PR:L, ACC v7 <= 7.4.4 build 9402 affected, fixed in 7.4.4 build 9403. Adobe: no known exploits. Vulnerable feature/endpoint not named in the bulletin; no workaround listed. Release notes say restart nlserver, Adobe-hosted already remediated.

## Documents

- [advisory] Adobe APSB26-162: Security update available for Adobe Campaign Classic https://www.adobe.com/trust/security/products/campaign/apsb26-162.html
- [fix] Adobe Campaign Classic v7 release notes (builds 9402, 9403) https://experienceleague.adobe.com/en/docs/campaign-classic/using/release-notes/latest-release

## From the sources

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_