VulnSocial

CVE-2026-82004Patch(adobe / campaign)

MEDIUMCVSS 10.0 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch adobe campaign systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

adobe CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-78

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • campaign

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 4 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-09-09); latest day: 1
  • 4 total mentions across 3 days

Affected systems

Vendors
adobe
Products
campaign

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-09-08: 1Mentions · 2026-09-09: 2Mentions · 2026-09-10: 1Active Exploitation · 2026-09-08: 1Patch / Workaround · 2026-09-08: 1Patch / Workaround · 2026-09-09: 2Patch / Workaround · 2026-09-10: 1Technical Details · 2026-09-08: 1Technical Details · 2026-09-09: 2Technical Details · 2026-09-10: 109-0809-0909-10
Signal classification2 categories
Patch
375.0%
Disclosure
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-081
Patch1
2026-09-092
Patch2
2026-09-101
Disclosure1
Full discourse4 posts
  • SecAlerts@SecAlertsCo
    Patch

    📧 Adobe Campaign Classic has a CVSS 10 OS command injection flaw. No auth needed, network-reachable, full RCE. CVE-2026-82004 is as bad as it gets. Patch now. #cybersecurity #ciso #cto #cio #vulnerabilities #msp #mssp https://secalerts.co/vulnerability/CVE-2026-82004?utm_campaign=x https://t.co/NikPdNYtG2

    Post summary

    Adobe Campaign Classic is affected by CVE‑2026‑82004, an OS command injection flaw that allows network‑reachable remote code execution; the advisory urges immediate patching.

    00010114
    889 followersView on X
  • kawn@kawn2020
    Patch

    #securityupdate #adobeupdate #adobe #CampaignClassic Adobe から，Campaign Classic で更新をリリース． 適用優先度「1」，緊急度には「Critical」 1 件（CVSS 10.0）． ・CVE-2026-82004 https://x.com/kawn2020/status/2097517202719355069

    Post summary

    Adobe has released a critical patch for Campaign Classic (CVE-2026-82004, CVSS 10.0), with no proof‑of‑concept or active exploitation details provided.

    1000053
    87 followersView on X
  • ThreatAft@ThreatAft
    Disclosure

    🚨 CVSS 10.0 — MAXIMUM SEVERITY Adobe Campaign Classic CVE-2026-82004 Unauthenticated OS command injection RCE Affected: 7.4.4 build 9401 and earlier Fixed: 7.4.4 build 9402 → https://threataft.com/articles/adobe-campaign-classic-cve-2026-82004-os-command-injection-rce #Adobe #CampaignClassic #CVE #RCE #CVSS10 #PatchNow #ThreatIntel

    Post summary

    The tweet announces a critical un‑authenticated OS command injection vulnerability (CVE‑2026‑82004) in Adobe Campaign Classic with CVSS score 10, affecting builds 7.4.4 build 9401 and earlier, and notes that a patch is available in build 9402.

    0000066
    43 followersView on X
  • Venkata Satish Guttula 🛰️@snakeyesV1
    Patch

    News: Adobe ships 170+ Sep patches. Campaign Classic CVE-2026-82004 (CVSS 10) OS command injection can run code; ColdFusion Priority 1 CVE-2026-48273 and CVE-2026-75746. Magento StyleSmuggler still in the wild. Apply Priority 1 within 3 days. https://www.securityweek.com/adobe-patches-over-170-vulnerabilities-including-commerce-zero-day/

    Post summary

    The article announces Adobe’s release of over 170 patches, highlighting critical CVEs with command‑injection risk and urging users to install Priority 1 fixes within three days, while noting that the Magento StyleSmuggler vulnerability remains active in the wild.

    00000114
    3.0K followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appadobecampaign---
Appadobecampaign7.4.4--
Appadobecampaign7.4.4--

Explore more

Back to dashboardadobe CVEscampaign vulnerabilities