Watching for Exploitation of the Adobe Campaign Classic Flaws While the Patch Is Pending

Adobe has patched eighteen critical vulnerabilities in Campaign Classic, but the window for patching leaves a gap for potential exploitation. Monitoring becomes crucial in this time frame, with a focus on identifying signs of exploitation. The National Cyber Security Centre of the Netherlands (NCSC-NL) advisory NCSC-2026-0393, along with Adobe's bulletin APSB26-142, details the affected classes: OS command injection, SQL injection, code injection, incorrect authorization, server-side request forgery, and insufficient input validation.

Ten of these flaws do not require authentication, with the most severe CVE-2026-75699 scoring a perfect 10.0. However, the advisory does not provide specific payloads, endpoints, or exploitation steps, necessitating the creation of detection rules based on behavioral categories rather than predefined indicators.

To monitor for these vulnerabilities, it's essential to look for unusual query construction and unexpected shell or process activity in application logs for the injection classes. Unauthorized requests to privileged functions from unexpected sources should also raise alerts. For the issue of server-side request forgery, monitoring outbound connections from the platform to internal addresses that are not typically connected can be beneficial.

These monitoring principles, rather than a set detection rule, are crucial for identifying potential exploitation during the patching gap.

Application and web server logs, outbound connection records from the platform hosts, and authentication audit trails are all important telemetry to capture. Since an unauthenticated flaw can produce activity before any login event, control failures visible only after authentication may not be detected. Therefore, network controls that limit who can reach the Campaign Classic endpoints during the upgrade period are the strongest available measure.

Restricting administrative interfaces to trusted networks and narrowing outbound access can reduce both initial access and any post-exploitation movement.

The patched version of Campaign Classic is 7.4.4 build 9402, and it's reported that hosted environments have already been updated. However, detection serves as a bridge to this state, not a replacement for it. ZoomEye reported 142 assets matching the title "Adobe Campaign" when checked, but no indexed assets were found for CVE-2026-75699. The fingerprint count describes deployed product instances rather than vulnerable hosts. References include the NCSC-NL advisory and Adobe's Security Bulletin.