# Adobe Campaign Classic Critical OS Command Injection (CVE-2026-82004, APSB26-142, CVSS 10.0)

> Adobe's September 2026 Patch Tuesday release (APSB26-142, 2026-09-08) fixes CVE-2026-82004, an unauthenticated OS command injection (CWE-78) in Adobe Campaign Classic v7 rated CRITICAL CVSS 10.0. The flaw allows remote arbitrary code execution in the context of the ACC service account on exposed on-premise and hybrid deployments; all builds up to 7.4.4 build 9401 (Windows and Linux) are affected, with build 9402 containing the fix. No in-the-wild exploitation or public PoC was reported at disclosure, but the vendor rates it Priority 1 (patch within 72 hours).

- **Published:** 2026-09-08T00:00:00Z
- **Last reviewed:** 2026-09-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2408
- **ID:** TL-2026-2408
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-82004

## Description

On September 8, 2026, Adobe released security bulletin APSB26-142 for Adobe Campaign Classic (ACC) v7 as part of its September 2026 security update cycle (over 170 vulnerabilities patched across Adobe products that day). The bulletin addresses CVE-2026-82004, an OS command injection vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command) rated CRITICAL with a CVSS 3.1 base score of 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The vulnerability could result in arbitrary code execution in the context of the current user: it is remotely exploitable over the network at low complexity, requires no privileges and no user interaction, and carries a changed scope, meaning the impact can extend to the underlying operating system, database connections, and connected CRM/integration endpoints beyond the ACC component itself. Affected builds are Adobe Campaign Classic v7 through 7.4.4 build 9401 on both Windows and Linux; the fix ships in 7.4.4 build 9402. Adobe-hosted (fully managed) instances are remediated by Adobe; on-premise and hybrid deployments with on-premise components must upgrade and restart the nlserver service for the fix to take effect.

The central attack surface for Campaign Classic is its SOAP web interface. All ACC functionality is exposed to the Rich Client (console), Thin Client (browser), and API integrations through POST /nl/jsp/soaprouter.jsp, the single SOAP routing endpoint served by the embedded Apache Tomcat JSP server inside the nlserver web process. SOAP envelopes dispatched through this endpoint (namespaces such as xtk:session, xtk:queryDef, nms:delivery) process user-controlled XML parameters, and the OS command injection sink in this processing path is the code-execution primitive behind CVE-2026-82004. This is not an isolated event: 2026 has seen a recurring series of CVSS 10.0 vulnerabilities in this same interface, including incorrect-authorization/Java-deserialization RCE (CVE-2026-48449, APSB26-114), SQL injection (CVE-2026-48448, APSB26-114), additional OS command injection and SSRF flaws (CVE-2026-76197, CVE-2026-76195, CVE-2026-76193, APSB26-134), and further incorrect-authorization arbitrary code execution issues (CVE-2026-48286, CVE-2026-48303, CVE-2026-27302, CVE-2026-71398), with Adobe itself attributing the increased discovery cadence in part to AI-assisted vulnerability discovery. This pattern makes ACC one of Adobe's most persistently targeted server products during 2026, alongside Commerce/Magento and ColdFusion, all of which received Adobe Deployment Priority 1 ratings in the September 2026 release.

At the time of disclosure no public proof-of-concept and no exploitation in the wild had been reported for CVE-2026-82004, and no Adobe Campaign Classic CVE is listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-09-08. NVD lists the record as undergoing analysis. AusCERT redistributed the Adobe bulletin to its Australian constituency as ESB-2026.10699 (published 2026-09-09 10:28 UTC+1000) with member-only technical detail; the AusCERT bulletin metadata confirms Product: Adobe Campaign Classic, Publisher: Adobe, OS: Windows and Linux, referencing the APSB26-142 advisory. Defenders should treat this as a should-patch-within-72-hours unauthenticated remote code execution class exposure on a product that handles large volumes of customer PII and campaign data, and should monitor for post-RCE activity consistent with web shell deployment, discovery, credential access, and data exfiltration if an ACC server is compromised.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1505.002 Transport Agent
- T1543.003 Create or Modify System Process: Windows Service
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.004 Remote Services: SSH

## Sources

- [Adobe Security Bulletin APSB26-142 - Campaign Classic](https://helpx.adobe.com/security/products/campaign/apsb26-142.html)
- [NVD - CVE-2026-82004](https://nvd.nist.gov/vuln/detail/CVE-2026-82004)
- [SecurityWeek: Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day](https://www.securityweek.com/adobe-patches-over-170-vulnerabilities-including-commerce-zero-day/)
- [AusCERT External Security Bulletin ESB-2026.10699](http://portal.auscert.org.au/bulletins/ESB-2026.10699/)
- [Adobe Security Bulletin APSB26-134 - Campaign Classic](https://helpx.adobe.com/security/products/campaign/apsb26-134.html)
- [NVD - CVE-2026-76197 (OS Command Injection, APSB26-134)](https://nvd.nist.gov/vuln/detail/CVE-2026-76197)
- [NVD - CVE-2026-76193 (SSRF, APSB26-134)](https://nvd.nist.gov/vuln/detail/CVE-2026-76193)
- [NVD - CVE-2026-48449 (Incorrect Authorization / deserialization RCE, APSB26-114)](https://nvd.nist.gov/vuln/detail/CVE-2026-48449)
- [NVD - CVE-2026-71398 (Incorrect Authorization, APSB26-123)](https://nvd.nist.gov/vuln/detail/CVE-2026-71398)
- [Adobe Campaign Classic Security Bulletins Overview](https://helpx.adobe.com/security/products/campaign.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2408