Adobe patches 8 critical Campaign Classic bugs. Don’t wait.

Adobe just shipped security fixes for Campaign Classic, and they’re not garden‑variety bugs. The Hacker News reports eight vulnerabilities that could enable arbitrary code execution, security feature bypass, and privilege escalation if an attacker reaches a vulnerable instance of Adobe’s marketing orchestration product (source).

At least one flaw is already cataloged: CVE‑2026‑104351 is described as a code injection issue with a CVSS base score of 9.9, near the top of the severity scale, meaning exploitation could yield full control of affected components (source).

What happened

Adobe released patches addressing eight Campaign Classic vulnerabilities whose combined impact spans three high‑risk buckets: arbitrary code execution, bypassing security features, and privilege escalation, according to The Hacker News (source).

One identified entry, CVE‑2026‑104351, carries a CVSS 9.9 severity and is categorized as code injection, a class that typically lets untrusted input reach an interpreter or runtime—opening the door to running commands under the server’s privileges (source).

The Hacker News notes that successful exploitation of these issues could let attackers execute arbitrary code, sidestep defenses that are supposed to contain abuse, or escalate to higher privileges on the box—each outcome magnifying risk across connected marketing workflows (source).

While the summary highlights the risks and one CVE, the implication is clear for operators: unpatched Campaign Classic servers are valuable targets because they sit on audience data, campaign logic, and connectors to sending infrastructure used for bulk email (source).

The background

Campaign Classic is the engine behind many organizations’ marketing journeys, where workflows build audiences, render content, and hand off to mail transfer agents—so a code‑execution foothold can quietly alter segments, content, or schedule without tripping mailbox‑side authentication controls like SPF, DKIM, and DMARC.

A CVSS 9.9 rating signals immediate operational risk: at that level, common scoring guidance assumes low attacker effort and high impact, making patch timelines a production concern, not a back‑burner security chore (source).

Security feature bypass and privilege escalation matter even if you tightly restrict shell access, because attackers who bypass app‑level checks or jump to elevated roles can export audience data, reconfigure delivery settings, or plant jobs that persist through restarts.

Compromise at the orchestration tier can also ripple into deliverability: if an attacker misuses your legitimate email infrastructure to send malicious content, blocklists may flag sending IPs or domains, forcing emergency remediations and hurting campaign performance. Our guide to keeping email upright during supply‑chain shocks explains how to contain that blast radius.

Past incidents show patch timing matters. When exploits arrive before administrators update, attackers get a head start. Our coverage of a web‑layer rush—“PHP2Shell went live before the patch”—outlines why rapid maintenance windows beat cleanup marathons later.

Even with pristine inbox authentication, governance gaps can still bite. If an attacker controls content or sequences, DMARC won’t save you from real mail doing the wrong thing. Our 30‑day lock‑down checklist pairs patching with access reviews to catch latent risks.

What people are saying

The Hacker News sums up Adobe’s advisory: “patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation,” and it explicitly lists CVE‑2026‑104351 as code injection with a CVSS 9.9 (source).

Vulnerability watchers tend to treat code injection in high‑privilege services as a red‑alert class because pre‑auth or weakly gated inputs can become single‑step execution paths. Even when exploitation requires authentication, marketing ops accounts often carry broad rights, compounding the impact of any session theft.

Deliverability teams reading Adobe advisories usually ask one thing first: will patching break sending? The practical answer is to plan a short maintenance window, upgrade all nodes in the Campaign Classic topology, then run a battery of smoke tests—seed list delivery, link tracking, and bounce processing—to confirm nothing regressed.

Security teams, for their part, will focus on exposure. Instances reachable from the internet, test servers left with default creds, or consoles bridged to production databases are the likeliest pivot points. Temporary mitigations like IP allowlisting and disabling unused endpoints can reduce risk while patches are staged.

If your martech stack feeds downstream AI assistants or workflow bots, unexpected changes to content or metadata can have unintended effects. We’ve seen how AI‑baited inbox tools can be steered by subtle inputs; integrity at the content source helps keep those helpers on‑task, not weaponized.

What happens next

Apply Adobe’s Campaign Classic updates across all environments, starting with internet‑exposed instances and any node that touches production data, then close the loop with log reviews for anomalous workflow edits or sudden permission changes around the maintenance window.

Rotate credentials that interact with Campaign Classic—API tokens, SFTP accounts, and service principals—because a patch fixes code, not secrets that may have been scraped before. Least‑privilege role reviews can trim unnecessary rights that turn small bugs into big incidents.

Monitor deliverability signals for two weeks post‑patch. If an attacker abused your infrastructure before you updated, you may see complaint spikes or blocklist appearances. Our four‑week DMARC plan offers a structure for tightening authentication while you remediate.

Finally, treat orchestration platforms as Tier‑1. That means documented patch SLAs, staging tests that mirror real sends, and a standing change window you can activate within hours—not days—when vendors flag code‑execution risk in software that touches your email program. For broader marketing ops context, browse our Marketing hub for playbooks that balance speed with safety.