CVE-2026-76197: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) in Adobe Adobe Campaign Classic

CVE-2026-76197 is an OS Command Injection vulnerability in Adobe Campaign Classic. It arises from improper neutralization of special elements in OS commands, enabling an attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code with the privileges of the current user, potentially leading to full system compromise, data loss, or service disruption. The vulnerability affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Adobe Campaign Classic instances and monitor for suspicious activity related to OS command execution.