Cpe:2.3:a:adobe:campaign:7.4.4:9401:*:*:classic:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aadobecampaign7.4.49401classic/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 03 Sep 2026 19:22:39 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAdobe Security Updates - September 2026https://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/Thu, 03 Sep 2026 19:22:39 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-adobe-security-updates/Roundup of Adobe security advisories published in September 2026.This roundup covers 24 Adobe security vulnerabilities. CVSS base scores range from 7.8 to 10.0. None are reported as actively exploited at the time of release. The issues affect Adobe Commerce, Campaign Classic, ColdFusion, Commerce, Experience Manager, Substance 3D Sampler.

Summary

CVE Product Severity CVSS EPSS KEV Source
CVE-2026-83959 Substance 3D Sampler High 7.8 0.17% no NVD (authoritative)
CVE-2026-75650 Adobe Commerce no NVD (authoritative)
CVE-2026-76200 Commerce Critical 9.3 0.46% no NVD (authoritative)
CVE-2026-76201 Commerce Critical 9.3 0.46% no NVD (authoritative)
CVE-2026-82004 Campaign Classic Critical 10.0 1.44% no NVD (authoritative)
CVE-2026-19232 Experience Manager Critical 9.9 0.57% no NVD (authoritative)
CVE-2026-48273 ColdFusion Critical 9.9 1.90% no NVD (authoritative)
CVE-2026-75746 ColdFusion Critical 9.1 1.07% no NVD (authoritative)
CVE-2026-73369 Campaign Classic no NVD (authoritative)
CVE-2026-75699 Campaign Classic Critical 10.0 no NVD (authoritative)
CVE-2026-75703 Campaign Classic no NVD (authoritative)
CVE-2026-75721 Campaign Classic no NVD (authoritative)
CVE-2026-75723 Campaign Classic Critical 10.0 no NVD (authoritative)
CVE-2026-75728 Campaign Classic no NVD (authoritative)
CVE-2026-82008 Campaign Classic no NVD (authoritative)
CVE-2026-82009 Campaign Classic Critical 9.1 no NVD (authoritative)
CVE-2026-82010 Campaign Classic Critical 9.9 no NVD (authoritative)
CVE-2026-82011 Campaign Classic no NVD (authoritative)
CVE-2026-82013 Campaign Classic no NVD (authoritative)
CVE-2026-82443 Campaign Classic no NVD (authoritative)
CVE-2026-83660 Campaign Classic no NVD (authoritative)
CVE-2026-84412 Campaign Classic no NVD (authoritative)
CVE-2026-89275 Campaign Classic no NVD (authoritative)
CVE-2026-89276 Campaign Classic no NVD (authoritative)

CVE-2026-83959

Adobe Substance 3D Sampler contains a heap-based buffer overflow vulnerability triggered by opening a malicious file. Successful exploitation allows an attacker to achieve arbitrary code execution in the context of the current user, requiring user interaction to open the crafted file.

Affected products:

  • Substance 3D Sampler

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-83959

CVE-2026-75650

Adobe Commerce contains a vulnerability involving improper neutralization of special elements used in a template engine, which allows an unauthenticated attacker to execute arbitrary code. The vulnerability is categorized as remote code execution, does not require user interaction, and impacts the integrity and availability of the system.

Affected products:

  • Adobe Commerce

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75650

CVE-2026-76200

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability allowing attackers to inject malicious JavaScript into form fields. When a victim accesses the affected page, the script executes within the victim's session, potentially leading to unauthorized account access or session hijacking.

Affected products:

  • Commerce

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-76200

Related in this roundup: CVE-2026-76201.

CVE-2026-76201

Adobe Commerce contains a stored Cross-Site Scripting (XSS) vulnerability allowing an attacker to inject malicious scripts into form fields. When a victim accesses the affected page, the script executes in their browser, potentially leading to session hijacking or unauthorized account access.

Affected products:

  • Commerce

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-76201

Related in this roundup: CVE-2026-76200.

CVE-2026-82004

Adobe Campaign Classic (ACC) is vulnerable to an OS command injection flaw (CVE-2026-82004) that allows unauthenticated attackers to achieve remote code execution in the context of the current user without requiring user interaction. The vulnerability has a CVSS v3.1 base score of 10.0 and involves a changed scope, indicating potential impact beyond the affected service.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82004

Related in this roundup: CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-19232

Adobe Experience Manager is vulnerable to an incorrect authorization flaw that allows a low-privileged attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and can result in the attacker gaining elevated access or control over a victim's session, leading to a full compromise of the affected account scope.

Affected products:

  • Experience Manager

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-19232

CVE-2026-48273

Adobe ColdFusion is vulnerable to an improper neutralization of directives in dynamically evaluated code (Eval Injection), which allows a low-privileged attacker to achieve remote code execution without user interaction. The vulnerability results in a change of scope, significantly increasing the impact of successful exploitation.

Affected products:

  • ColdFusion

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-48273

Related in this roundup: CVE-2026-75746.

CVE-2026-75746

Adobe ColdFusion is vulnerable to a high-severity SQL injection flaw (CVE-2026-75746) that allows a highly privileged attacker to achieve remote code execution. The vulnerability does not require user interaction and impacts the integrity and availability of the application environment.

Affected products:

  • ColdFusion

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75746

Related in this roundup: CVE-2026-48273.

CVE-2026-73369

Adobe Campaign Classic (ACC) is vulnerable to a code injection vulnerability (CVE-2026-73369) that allows for remote code execution in the context of the current user. The vulnerability does not require user interaction for exploitation and is classified as having a CVSS v3.1 base score of 10.0.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-73369

Related in this roundup: CVE-2026-82004, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-75699

Adobe Campaign Classic (ACC) contains a code injection vulnerability that allows an unauthenticated attacker to execute arbitrary code with the privileges of the application user. This issue is categorized as a critical risk with a CVSS score of 10.0, as it does not require user interaction and impacts the overall system integrity and confidentiality.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75699

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-75703

CVE-2026-75703 identifies an improper control of generation of code vulnerability in Adobe Campaign Classic (ACC). The vulnerability allows a remote, unauthenticated attacker to execute arbitrary code in the context of the current user without requiring user interaction. The impact includes a full compromise of the service integrity and availability (CVSS 10.0), necessitating immediate patching.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75703

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-75721

Adobe Campaign Classic is vulnerable to an Improper Control of Generation of Code ('Code Injection') vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code within the context of the application user. The vulnerability carries a CVSS base score of 10.0 and does not require user interaction to exploit.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75721

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-75723

Adobe Campaign Classic (ACC) is vulnerable to an incorrect authorization flaw that allows an attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and impacts the system scope, presenting a high risk for potential exploitation.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75723

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-75728

Adobe Campaign Classic (ACC) contains an incorrect authorization vulnerability that allows an unauthenticated attacker to achieve arbitrary code execution. The vulnerability does not require user interaction, making it a critical risk for deployments of the affected software.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-75728

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-82008

Adobe Campaign Classic (ACC) is vulnerable to an improper input validation flaw that allows a low-privileged attacker to achieve remote code execution in the context of the current user without requiring user interaction. The vulnerability is considered high severity due to the potential for arbitrary code execution.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82008

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-82009

Adobe Campaign Classic (ACC) is vulnerable to a high-severity SQL injection flaw (CVE-2026-82009) that allows authenticated attackers with high privileges to execute arbitrary SQL commands. Successful exploitation can lead to arbitrary code execution within the context of the current user without requiring user interaction.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82009

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-82010

Adobe Campaign Classic (ACC) contains an SQL injection vulnerability that can be exploited by a low-privileged attacker to achieve arbitrary code execution. The vulnerability does not require user interaction and impacts the overall scope of the target application.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82010

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-82011

Adobe Campaign Classic is vulnerable to an SQL injection vulnerability that allows low-privileged attackers to bypass security measures, resulting in unauthorized read and limited write access to the application data. The vulnerability does not require user interaction and impacts the overall security scope of the affected system.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82011

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-82013

Adobe Campaign Classic (ACC) is vulnerable to a Server-Side Request Forgery (SSRF) flaw that allows low-privileged, unauthenticated attackers to perform privilege escalation. An attacker can leverage this vulnerability to gain unauthorized access to internal resources, with the exploit not requiring user interaction.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82013

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-82443

Adobe Campaign Classic (ACC) is vulnerable to a Server-Side Request Forgery (SSRF) flaw that allows a low-privileged attacker to achieve privilege escalation. The vulnerability is exploitable remotely without user interaction and results in a change of security scope, potentially granting the attacker unauthorized access to internal resources.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-82443

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-83660

Adobe Campaign Classic (ACC) is vulnerable to a Server-Side Request Forgery (SSRF) flaw that can be exploited by a remote attacker without user interaction to achieve privilege escalation. Due to the changed scope of the vulnerability and the high CVSS score, it represents a significant risk to the integrity and authorization controls of the Campaign Classic environment.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-83660

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-84412, CVE-2026-89275, CVE-2026-89276.

CVE-2026-84412

Adobe Campaign Classic (ACC) is susceptible to a code injection vulnerability that allows an unauthenticated remote attacker to execute arbitrary code within the context of the current user. The vulnerability does not require user interaction and involves a change in scope, carrying a CVSS base score of 10.0.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-84412

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-89275, CVE-2026-89276.

CVE-2026-89275

Adobe Campaign Classic (ACC) is vulnerable to a code injection vulnerability, classified as CVE-2026-89275, which allows an unauthenticated attacker to achieve remote code execution in the context of the current user. The vulnerability does not require user interaction and involves a change in scope, carrying a CVSS v3.1 base score of 10.0.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-89275

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89276.

CVE-2026-89276

CVE-2026-89276 is a critical code injection vulnerability in Adobe Campaign Classic that allows a low-privileged attacker to achieve remote code execution without user interaction. The vulnerability results in a change of scope, and successful exploitation grants the attacker the execution privileges of the current user context.

Affected products:

  • Campaign Classic

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-89276

Related in this roundup: CVE-2026-82004, CVE-2026-73369, CVE-2026-75699, CVE-2026-75703, CVE-2026-75721, CVE-2026-75723, CVE-2026-75728, CVE-2026-82008, CVE-2026-82009, CVE-2026-82010, CVE-2026-82011, CVE-2026-82013, CVE-2026-82443, CVE-2026-83660, CVE-2026-84412, CVE-2026-89275.

]]>highthreatroundup