Three Critical Vulnerabilities in Adobe Campaign Classic Allow Arbitrary Code Execution
Adobe has disclosed three critical vulnerabilities in Adobe Campaign Classic that could allow attackers to execute arbitrary code on affected systems.
The flaws impact both Windows and Linux versions. Adobe published a security advisory on August 25, 2026, detailing two OS command injection vulnerabilities tracked as CVE-2026-76197 and CVE-2026-76195, as well as one server-side request forgery (SSRF) vulnerability identified as CVE-2026-76193.
All three issues received the highest possible CVSSv3.1 base score of 10.0 and are rated Critical. Successful exploitation could lead to full compromise of the Campaign Classic instance.
Adobe has released patched version 7.4.4 build 9401 for both Windows and Linux. The update applies to on-premises deployments as well as the on-premises components used in hybrid environments.
No in-the-wild attacks have been observed at the time of disclosure. Nevertheless, Adobe assessed the exploitation risk as high and assigned the highest remediation priority of 1, advising organizations to apply the update within 72 hours.
Related articles
Veeam ONE Receives Security Update Addressing Critical Vulnerabilities Including CVE-2026-65641
Veeam Software has released updates for its backup environment monitoring tool Veeam ONE to address multiple vulnerabilities. The advisory covers the 13.x series and includes fixes rated as critical under CVSSv4.0. One flaw, CVE-2026-65641, allows service accounts to perform SMB authentication and carries a base score of 9.3. Additional high-severity issues such as CVE-2026-64633 with a perfect 10.0 score were also resolved in the patches. The company updated its disclosure to include seven vulnerabilities fixed in version 13.1.0.7034 after initially reporting six. Patches are now available for both the 13.x and 12.x branches, with the latest 12.3 Patch 1 backporting several fixes from the 13 series.
Dirty COW CVE-2016-5195: How a 2016 Linux Kernel Race Condition Still Enables Privilege Escalation in Embedded Systems
The 2016 Linux kernel vulnerability CVE-2016-5195, known as Dirty COW, allowed local users to bypass copy-on-write protections and modify read-only memory mappings through a race condition involving writes to /proc/self/mem and madvise calls. Although patched in supported distributions years ago, the flaw persists in older kernels running on routers, cameras, and industrial controllers that receive infrequent firmware updates. Public exploits often target /etc/passwd or SUID binaries for root access, but success depends heavily on the presence of login mechanisms, BusyBox applets, and suitable binaries in the target environment. When standard targets are absent, attackers may pivot to overwriting vDSO functions in process memory to inject code executed by higher-privileged processes. The article explains why ready-made PoCs frequently fail on minimal BusyBox-based systems and outlines the checks required for architecture, ABI, vDSO symbols, and payload compatibility. It also references the practical exercise Strange And Dirty on the free White Hacker course for hands-on adaptation of the exploit chain.
Critical Authentication Bypass Vulnerability Found in OAuth2 Proxy, No Patch Released
A severe authentication bypass vulnerability has been identified in the OAuth2 Proxy authentication proxy, tracked as CVE-2026-76835. The issue allows attackers to circumvent authentication by sending crafted X-Forwarded-Uri headers when the trusted_proxy_ip setting is not configured. This affects default reverse proxy configurations and enables unauthorized access to protected paths. Although version 7.15.2 addressed a related flaw under CVE-2026-40575, the vulnerability persists in standard reverse proxy setups. VulnCheck rated the flaw with a CVSS v4.0 base score of 9.3, classifying it as Critical. No patched release is currently available despite ongoing work in the source repository.
Starting in Bug Bounty: Understanding 1-Day Vulnerabilities
Mikhail Klyuchnikov, known in the bug hunting community as n1, shares his decade-long experience at Positive Technologies leading a team focused on software security analysis. The team specializes in discovering new zero-day vulnerabilities while also reproducing known 1-day issues to support penetration testing engagements. Klyuchnikov is also a member of the PT SWARM team, which regularly publishes technical articles, tips, and timely vulnerability breakdowns. With extensive participation in international bug bounty platforms and the Russian Standoff Bug Bounty program, he aims to explain the practical role of 1-day vulnerabilities for newcomers entering bug bounty hunting. The article provides foundational knowledge on how security researchers leverage publicly disclosed vulnerabilities in real-world testing scenarios.