CVE-2026-104353

Summary

Adobe Campaign Classic contains an OS command injection flaw (CWE-78) that allows low-privileged attackers to execute arbitrary commands on the underlying host without user interaction, leading to full system compromise including confidentiality, integrity, and availability impacts.

Exploitability

Exploitation is straightforward for a low-privileged attacker with network access to the vulnerable Adobe Campaign Classic instance, requiring no user interaction.

Blast radius

Successful exploitation grants attackers the privileges of the affected service account, enabling full system compromise including data theft, malware deployment, and lateral movement within the environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Adobe Campaign Classic version 2.590 or later, as this is the fixed version that addresses CVE-2026-104353.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.