CVE-2026-82004 – Adobe Campaign Classic
“Seventeen critical doors into your customer engagement engine, and not one of them needs a user to click before an attacker walks through.”
This Adobe Campaign Classic update fixes 17 Critical vulnerabilities, and none of them needs user interaction to exploit. Code injection, OS command injection, and improper input validation flaws let attackers run arbitrary code on the server. SQL injection flaws let attackers run arbitrary SQL commands or bypass security controls to read and alter data. Incorrect authorization and server-side request forgery flaws give attackers elevated access to internal resources. Most of these flaws have a changed scope, so a successful attack can reach systems beyond Campaign Classic. Several need only a low-privileged account.
CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-82004, CVE-2026-84412, and CVE-2026-89275 each have a CVSS score of 10.0, Critical severity. CVE-2026-82008, CVE-2026-82010, CVE-2026-82013, CVE-2026-83660, and CVE-2026-89276 each have a CVSS score of 9.9, Critical severity. CVE-2026-82443 has a CVSS score of 9.6, Critical severity. CVE-2026-75728, CVE-2026-82009, and CVE-2026-82011 each have a CVSS score of 9.1, Critical severity.
Key Details
- Affected Product
- Adobe Campaign
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-78