CVE-2026-75699 and 6 Critical Adobe Campaign Classic Code Injection Flaws on Windows — Detection and Remediation Guide

---
title: Adobe Campaign Classic nlserver Spawning Shell or Script Interpreter
description: Detects cmd.exe, powershell.exe, or scripting hosts spawned by the Adobe Campaign Classic nlserver process, consistent with code injection exploitation (CVE-2026-75699 / CVE-2026-75721).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75699
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/04
status: experimental
id: 3f7a1c94-2b6e-4d58-9a31-7c0e5f82a1b6
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\nlserver.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - ACC workflow activities legitimately invoking command-line jobs (audit workflow definitions before whitelisting)
level: critical
---
title: Suspicious Process Execution from Adobe Campaign Installation Directory
description: Detects execution of binaries or scripts from Adobe Campaign Classic installation or data directories that are not the core nlserver components, indicating dropped payloads after code injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75699
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/05/04
status: experimental
id: 8b2d5e17-6a4f-4c91-b3d8-0f1a9e27c5d3
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\Adobe Campaign\'
      - '\AdobeCampaign\'
      - '\Neolane\'
  filter_legit:
    Image|endswith:
      - '\nlserver.exe'
      - '\nlclient.exe'
      - '\setupclient.exe'
      - '\watchdog.exe'
      - '\inMail.exe'
      - '\mta.exe'
      - '\webmdl.exe'
      - '\trackinglogd.exe'
      - '\stat.exe'
      - '\wfserver.exe'
      - '\syslogd.exe'
      - '\nlrunsv.exe'
  condition: selection_path and not filter_legit
falsepositives:
  - Third-party plugins or custom utilities installed into the ACC directory by administrators
level: high
---
title: Outbound Network Connection from Adobe Campaign nlserver to Uncommon Destination
description: Detects nlserver.exe establishing outbound connections to non-standard ports or external hosts, which may indicate C2 activity following code injection exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75699
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/05/04
status: experimental
id: c41f9a63-1d8b-4e72-a6c4-2b9d3f58e7a0
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\nlserver.exe'
    Initiated: 'true'
  filter_common:
    DestinationPort:
      - 25
      - 80
      - 443
      - 587
      - 1433
      - 1521
      - 5432
      - 8080
  condition: selection and not filter_common
falsepositives:
  - Custom integrations (SFTP, API endpoints on non-standard ports) - baseline ACC server egress before enabling at high volume
level: medium

// Hunt for shell/script interpreters spawned by Adobe Campaign Classic (nlserver) —
// consistent with code injection exploitation (CVE-2026-75699 / CVE-2026-75721).
// Covers the last 14 days; extend for retro-hunting after patching.
let lookback = 14d;
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","certutil.exe","bitsadmin.exe"]);;
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| where InitiatingProcessFileName =~ "nlserver.exe"
| where FileName has_any (suspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine,
          ProcessId, InitiatingProcessId, SHA256
| order by TimeGenerated desc
;
// Companion hunt: network connections initiated by nlserver to rare external destinations
DeviceNetworkEvents
| where TimeGenerated >= ago(lookback)
| where InitiatingProcessFileName =~ "nlserver.exe"
| where RemoteIPType == "Public"
| summarize ConnectionCount = count(), Ports = make_set(RemotePort),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteIP, RemoteUrl
| order by ConnectionCount asc

-- Hunt: Adobe Campaign Classic code injection post-exploitation artifacts
-- 1) nlserver child processes (shells, script hosts, LOLBins)
-- 2) Recently modified executables/scripts in ACC directories

LET acc_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|certutil|bitsadmin)'
  AND CommandLine =~ '(?i)(campaign|neolane|nlserver)'

LET acc_files = SELECT FullPath, Mtime, Ctime, Size
FROM glob(globs=['C:\\Program Files\\Adobe\\Adobe Campaign\\**\\*.exe',
                 'C:\\Program Files (x86)\\Adobe\\Adobe Campaign\\**\\*.exe',
                 'C:\\Program Files\\Adobe\\Adobe Campaign\\**\\*.ps1',
                 'C:\\Program Files\\Adobe\\Adobe Campaign\\**\\*.bat'])
WHERE Mtime > now() - 86400 * 14

SELECT * FROM acc_procs
UNION ALL
SELECT NULL, NULL, NULL, NULL, FullPath, 'FILE', Mtime FROM acc_files

# Adobe Campaign Classic — CVE-2026-75699 / -75721 verification & exposure check
# Run as Administrator on each ACC server

# 1) Identify installed ACC build (record for comparison against Adobe's patched build list)
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
                 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -match 'Adobe Campaign|Neolane' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation

# 2) Confirm nlserver service account context (should NOT be SYSTEM/Administrator)
Get-CimInstance Win32_Service |
  Where-Object { $_.PathName -match 'nlserver|Adobe Campaign' } |
  Select-Object Name, State, StartName, PathName

# 3) Check listening exposure of ACC ports (80/443 connector, 8080 app server)
Get-NetTCPConnection -State Listen |
  Where-Object { $_.LocalPort -in 80,443,8080 } |
  Select-Object LocalAddress, LocalPort, OwningProcess,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).ProcessName}}

# 4) Audit Windows Firewall rules permitting ACC ports from broad scopes
Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -in 80,443,8080 } |
  ForEach-Object { Get-NetFirewallRule -AssociatedNetFirewallPortFilter $_ } |
  Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' } |
  Select-Object DisplayName, Action, Profile

# 5) Hunt for recently created persistence on the ACC host (last 14 days)
$cutoff = (Get-Date).AddDays(-14)
Get-CimInstance Win32_Service | Where-Object { $_.InstallDate -gt $cutoff } |
  Select-Object Name, PathName, StartName
Get-ScheduledTask | Where-Object { $_.Date -and (Get-Date $_.Date) -gt $cutoff } |
  Select-Object TaskName, TaskPath, Date
Get-LocalUser | Where-Object { $_.Created -gt $cutoff } |
  Select-Object Name, Created, Enabled

# 6) Pull recent suspicious child processes of nlserver from Security log (4688)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$cutoff} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'nlserver\.exe' -and
                 $_.Message -match '(cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe)' } |
  Select-Object TimeCreated, Message -First 50