CVE-2026-89276 is a critical (CVSS 9.9) code injection flaw in Adobe Campaign Classic. A low-privileged attacker can run arbitrary code in the context of the current user, with no user interaction and a changed scope. Apply the update named in Adobe security bulletin APSB26-142.
What's affected
The record lists Adobe Campaign on Windows and Linux. It does not list version numbers, and the Adobe bulletin APSB26-142 could not be loaded when this guide was written, so the bulletin is the place to find affected versions and the update that fixes them.
The vector shows network access with low privileges and no user interaction. Because the scope is changed, the effects reach beyond the application itself.
How to check if you're exposed
Find the build number of each Campaign Classic instance in the client console, under the About information, and compare it with the bulletin.
Then list who holds accounts. The attacker needs only a low-privileged login, so a platform with many marketing operators, agency users or service accounts has a wider exposure. Also check the network placement of the application servers, and what the service account can reach.
What to do now
- Read bulletin APSB26-142 and find the fixed build for your version.
- Apply the update to all instances, starting with those reachable from the internet.
- Review accounts and remove those that are no longer needed.
- Limit the service account of the application to the minimum access it needs.
- Check logs for unusual activity by low privilege accounts before the patch.
Why it matters
The weakness is CWE-94 (improper control of generation of code). Adobe describes it as code injection that results in code execution in the context of the current user. Code injection flaws occur when input is treated as instructions by an interpreter or template engine.
The 9.9 score is among the highest possible without a perfect 10, because a low privilege login is enough and the impact crosses a security boundary. Campaign platforms also hold customer contact data and connect to mail systems, so the data at stake is sensitive.
The record does not mark this CVE as known exploited, and it is not in the CISA KEV list.
Quick check
Which version fixes it?
I could not load the Adobe bulletin. Read APSB26-142 for the fixed build.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Listed in the record but not readable when this guide was written, so confirm details there:
Last reviewed: 19 October 2026.
