# CVE-2026-104353: Adobe Campaign Classic OS command injection

Source: https://junglewise.ai/threats/cve-2026-104353-adobe-campaign-classic-acc-is-affected-by-an-improper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-104353 · Severity: critical · CVSS 9.9 · Published 2026-10-27

Adobe Campaign Classic is a marketing automation and customer data platform used by enterprises to manage campaigns and customer relationships. This OS command injection vulnerability allows a low-privileged attacker to execute arbitrary code on the server without user interaction, potentially compromising the entire system and exposing sensitive customer data. The vulnerability affects Campaign Classic v7 versions up to 7.4.4 build 9402.

Technologies: [Adobe Campaign Classic](https://junglewise.ai/threats/technologies/campaign-classic). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-104353 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104353 being exploited in the wild.

**How severe is CVE-2026-104353?** Critical severity, with a CVSS score of 9.9, published 27 October 2026.

**Which products and versions are affected?** Adobe Campaign Classic v7 up to 7.4.4 build 9402.

**Is there a fix for CVE-2026-104353?** Yes: fixed in Adobe Campaign Classic ACC v7 7.4.4 build 9403. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104353 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-104353?** Check whether you run Adobe Campaign Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Adobe Campaign Classic ACC v7 7.4.4 build 9403

## Technical details

An improper neutralization of special elements in OS commands (CWE-78) allows a low-privileged authenticated attacker to inject arbitrary operating system commands via network vector. The vulnerability does not require user interaction and has changed scope, meaning exploitation can impact resources beyond the vulnerable component. A fix is available in build 9403.

## Affected products

- Adobe Campaign Classic v7 up to 7.4.4 build 9402

## Timeline

- 2026-10-27: disclosed
- 2026-10-27: advisory: Adobe APSB26-162

## References

- [https://www.adobe.com/trust/security/products/campaign/apsb26-162.html](https://www.adobe.com/trust/security/products/campaign/apsb26-162.html)

## Related threats

- [Adobe Campaign Classic SQL injection in security feature bypass](https://junglewise.ai/threats/cve-2026-105781-adobe-campaign-classic-acc-is-affected-by-an-improper)
- [Adobe Campaign Classic authorization bypass allowing arbitrary code execution](https://junglewise.ai/threats/cve-2026-105780-adobe-campaign-classic-acc-is-affected-by-an-incorrect)
- [Adobe Campaign Classic SQL injection security feature bypass](https://junglewise.ai/threats/cve-2026-105779-adobe-campaign-classic-acc-is-affected-by-an-improper)
- [Adobe Campaign Classic SQL injection in security feature](https://junglewise.ai/threats/cve-2026-105489-adobe-campaign-classic-acc-is-affected-by-an-improper)
- [Adobe Campaign Classic SQL injection in security feature bypass](https://junglewise.ai/threats/cve-2026-104354-adobe-campaign-classic-acc-is-affected-by-an-improper)