Eighteen critical Adobe Campaign Classic flaws patched, many deployments still exposed

Adobe's September 2026 security release closed eighteen critical vulnerabilities in Campaign Classic, but the risk now sits in the interval between that patch shipping and organisations actually installing it. A dev.to analysis published on 27 September works through what defenders can realistically do while their change windows catch up, drawing on the Dutch national CERT's advisory and Adobe's own bulletin.

What the advisories say

According to the dev.to write-up, NCSC-NL advisory NCSC-2026-0393, issued on 24 September 2026 alongside Adobe bulletin APSB26-142, lists the affected weakness classes: OS command injection, SQL injection, code injection, incorrect authorization, server-side request forgery and insufficient input validation. Ten of the eighteen flaws can be triggered without any authentication, and one of them, CVE-2026-75699, carries a maximum 10.0 severity score.

Neither document publishes payloads, endpoints or exploitation steps, so there is no supplied indicator list to build signatures from. Detection instead has to be reasoned from the vulnerability categories themselves.

Detection by behaviour, not signatures

The monitoring suggestions in the piece map directly onto the listed classes. For the injection family, the signals worth alerting on are oddly constructed queries and shell or process activity that has no business appearing in the application log. For the authorization flaws, it is successful calls to privileged functions arriving from sources with no plausible reason to make them. For server-side request forgery, the useful telemetry is outbound traffic from the platform's hosts toward internal addresses the system rarely or never contacts.

The author frames these as monitoring principles for the listed weakness classes rather than a published detection rule set.

Telemetry to keep, and a timing trap

Application and web server logs, outbound connection records from the platform hosts, and authentication audit trails all earn their keep here. The timing detail matters: because an unauthenticated flaw rated 10.0 generates activity before any login event, checks that only surface problems after authentication will not see it.

Network controls that buy time

Where the upgrade is scheduled but not yet applied, limiting who can reach Campaign Classic endpoints is described as the strongest control available. Pulling administrative interfaces back onto trusted networks and tightening outbound access shrink both the initial attack surface and the room an attacker has to move after a successful exploit.

The patch that ends the window

The fixed release is Campaign Classic 7.4.4 build 9402, and hosted environments are reported as already updated. The article is explicit that monitoring only carries a team until that state is reached; it does not replace the upgrade.

What the internet shows

ZoomEye, cited in the dev.to piece, returned 142 assets for a product-title search on "Adobe Campaign" at the time it was checked, and no indexed assets tagged with CVE-2026-75699. The author cautions that this figure counts deployed product instances, not confirmed vulnerable hosts, so it sketches the potential footprint rather than measuring it.

Why it matters

A marketing automation platform holds contact data, sending credentials, integration keys and a foothold inside corporate networks. Unauthenticated command injection and SSRF in that kind of system offer a direct route to compromise, and attackers read advisories as eagerly as defenders do. With ten unauthenticated flaws and a maximum-severity CVE in the same batch, the stretch between a patch's release and its installation is exactly when exploitation attempts should be expected. Any organisation still on an older Campaign Classic build should treat the upgrade as urgent and, until it lands, put the compensating controls in place: restricted access to the platform, tighter egress, and behavioural alerting tuned to the weakness classes the advisories list.