Threat Overview
Adobe published security bulletin APSB26-162 on October 27, 2026, fixing eight critical vulnerabilities in Adobe Campaign Classic v7. Three paths can lead to arbitrary code execution: CVE-2026-104351 (code injection), CVE-2026-104353 (OS command injection), and CVE-2026-105780 (incorrect authorization). Four SQL injection issues—CVE-2026-105489, CVE-2026-105781, CVE-2026-104354 and CVE-2026-105779—can bypass security features. CVE-2026-104350 is reflected XSS with possible privilege escalation. Several flaws score CVSS 9.9. No public exploit endpoint, payload, IOC or active campaign was verified for this bulletin.
References
Adobe APSB26-162 — October 27, 2026
The Hacker News — October 28, 2026
Impacted Systems
Adobe Campaign Classic ACC v7 7.4.4 build 9402 and earlier on Windows and Linux; fixed in 7.4.4 build 9403. Network exposure and authentication requirements vary by affected component. Several RCE flaws require low privileges; one SQL injection flaw is rated no privileges required. Adobe Campaign Standard, Adobe Commerce and Adobe Connect are not asserted affected by this bulletin.
Why this matters
Enterprise marketing platforms store customer data and interact with databases and business integrations. Exploitation of code injection or authorization flaws on an exposed Campaign server could allow server compromise, data theft or privilege escalation.
Exploitation Status
Adobe explicitly stated on October 27 that it was not aware of in-the-wild exploitation for the issues in APSB26-162. The vulnerability categories and fixed build are confirmed; specific attack requests and campaign IOCs are not published.
What this hunt looks for
WAF injection alerts on known Campaign endpoints, campaign-specific IPS alerts where available, nlserver child-shell activity, script creation, new outbound destinations, Windows process-audit fallback and Linux application error logs.
Required logs
AzureDiagnostics WAF, CommonSecurityLog, DeviceProcessEvents, DeviceFileEvents, DeviceNetworkEvents, SecurityEvent 4688 or Syslog as ingested into Microsoft Sentinel. Each query uses one specified table; asset-scoping to confirmed Campaign hosts is necessary for meaningful results.
Hunt 01 — Adobe Campaign WAF code and SQL injection signals
AzureDiagnostics
| where TimeGenerated > ago(30d)
| where Category has 'WebApplicationFirewall'
| extend Rule=tolower(strcat(tostring(column_ifexists('ruleName_s','')), ' ', tostring(column_ifexists('details_message_s','')), ' ', tostring(column_ifexists('details_data_s',''))))
| where Rule has_any ('sqli','sql injection','rce','command injection','code injection','xss')
| project TimeGenerated, ResourceId, clientIP_s=column_ifexists('clientIP_s',''), requestUri_s=column_ifexists('requestUri_s',''), action_s=column_ifexists('action_s',''), Rule
| order by TimeGenerated descHunt 02 — Adobe Campaign IPS and security gateway detections
CommonSecurityLog
| where TimeGenerated > ago(30d)
| extend M=tolower(strcat(tostring(column_ifexists('Message','')), ' ', tostring(column_ifexists('Activity','')), ' ', tostring(column_ifexists('DeviceEventClassID',''))))
| where M contains 'adobe campaign' or M contains 'nlserver' or M contains 'cve-2026-104351' or M contains 'cve-2026-104353' or M contains 'cve-2026-105780'
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DeviceAction, RequestURL, Message
| order by TimeGenerated descHunt 03 — Adobe Campaign nlserver spawning shell or transfer tools
DeviceProcessEvents
| extend EventTime=coalesce(todatetime(column_ifexists('TimeGenerated',datetime(null))),todatetime(column_ifexists('Timestamp',datetime(null))))
| where EventTime > ago(30d)
| extend Parent=tolower(InitiatingProcessFileName)
| where Parent contains 'nlserver' or tolower(InitiatingProcessCommandLine) contains 'nlserver'
| where FileName in~ ('cmd.exe','powershell.exe','pwsh.exe','bash','sh','curl','wget','certutil.exe','python','python3')
| project EventTime, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by EventTime descHunt 04 — Adobe Campaign service creates scripts or executables
DeviceFileEvents
| extend EventTime=coalesce(todatetime(column_ifexists('TimeGenerated',datetime(null))),todatetime(column_ifexists('Timestamp',datetime(null))))
| where EventTime > ago(30d)
| where tolower(InitiatingProcessFileName) contains 'nlserver' or tolower(InitiatingProcessCommandLine) contains 'nlserver'
| where FileName matches regex @'(?i)\.(ps1|sh|bat|cmd|exe|dll|py|jsp)$'
| where ActionType in~ ('FileCreated','FileModified','FileRenamed')
| project EventTime, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by EventTime descHunt 05 — Adobe Campaign process new external destinations
let base=DeviceNetworkEvents
| extend EventTime=coalesce(todatetime(column_ifexists('TimeGenerated',datetime(null))),todatetime(column_ifexists('Timestamp',datetime(null))))
| where EventTime between (ago(30d)..ago(2d)) and tolower(InitiatingProcessFileName) contains 'nlserver'
| summarize by DeviceName, RemoteIP;
DeviceNetworkEvents
| extend EventTime=coalesce(todatetime(column_ifexists('TimeGenerated',datetime(null))),todatetime(column_ifexists('Timestamp',datetime(null))))
| where EventTime > ago(2d) and tolower(InitiatingProcessFileName) contains 'nlserver'
| where isnotempty(RemoteIP) and not(ipv4_is_private(RemoteIP))
| join kind=leftanti base on DeviceName, RemoteIP
| project EventTime, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessCommandLine
| order by EventTime descHunt 06 — Adobe Campaign Windows SecurityEvent 4688 fallback
SecurityEvent
| where TimeGenerated > ago(30d) and EventID == 4688
| extend Parent=tolower(tostring(column_ifexists('ParentProcessName',''))), Child=tolower(tostring(column_ifexists('NewProcessName',''))), Cmd=tolower(tostring(column_ifexists('CommandLine','')))
| where Parent contains 'nlserver' or Cmd contains 'nlserver'
| where Child has_any ('cmd.exe','powershell.exe','pwsh.exe','certutil.exe') or Cmd has_any ('downloadstring','invoke-webrequest',' -enc ')
| project TimeGenerated, Computer, Account, Parent, Child, Cmd
| order by TimeGenerated descHunt 07 — Adobe Campaign Linux Syslog anomalies
Syslog
| where TimeGenerated > ago(30d)
| extend M=tolower(SyslogMessage)
| where M contains 'nlserver' or M contains 'adobe campaign'
| where M has_any ('exception','unauthorized','denied','sql','command','crash','segfault','permission')
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated descDetection Notes
No CVE-specific request paths or verified indicators are available, so these are behavior-oriented follow-up hunts rather than exploit fingerprints. Start with WAF injection matches scoped to confirmed Campaign hosts, then correlate nlserver child shells and suspicious script writes. SQL injection patterns and new outbound Campaign connections can be legitimate or noisy. Missing WAF request details, EDR, 4688 command lines or application Syslog limits visibility. No customer-specific workspace was queried; no findings are asserted.
