{"id":"CVE-2026-104353","published":"2026-10-27T17:16:55.717","lastModified":"2026-10-27T17:16:55.717","description":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/campaign/apsb26-162.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Campaign Classic contains an OS command injection flaw (CWE-78) that allows low-privileged attackers to execute arbitrary commands on the underlying host without user interaction, leading to full system compromise including confidentiality, integrity, and availability impacts.","exploitability":"Exploitation is straightforward for a low-privileged attacker with network access to the vulnerable Adobe Campaign Classic instance, requiring no user interaction.","blast_radius":"Successful exploitation grants attackers the privileges of the affected service account, enabling full system compromise including data theft, malware deployment, and lateral movement within the environment.","remediation":"Upgrade to Adobe Campaign Classic version 2.590 or later, as this is the fixed version that addresses CVE-2026-104353.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["os-command-injection","rce","low-privilege-exploit","no-user-interaction","web-application"],"model":"garnet-coder","analyzedAt":"2026-10-28T09:57:05.288Z"}}