Adobe Campaign Classic v7 Build 9401 Becomes Current GA Release After September 3 Update
Adobe Campaign Classic v7 build 9401 is now the current General Availability release after a September 3, 2026 update to Adobe’s latest Campaign Classic v7 release notes, with an immediate September 5 allow list action for delivery content and attachments. The update matters most for on-premise and hybrid Campaign Classic estates because the same build is tied to a Priority 1 security bulletin and requires local operational checks before live deliveries are affected.
Adobe Campaign Classic v7 build 9401 becomes the listed GA release
The September 3 release note update lists Adobe Campaign Classic v7 Release 7.4.4 build 9401 as General Availability, with an original build date of August 25, 2026. Adobe says the build includes security updates for critical vulnerabilities, and the fix becomes active after the Adobe Campaign server, nlserver, is restarted.
In practice, that restart detail is important. A package can be installed correctly but still leave the old server process running until services are bounced, which is where patch validation often fails in managed maintenance windows.
September 5 URL allow list deadline affects Adobe Campaign delivery content
The same Adobe Campaign Classic v7 release entry adds an external URL allow list update for delivery content and attachments. Adobe tells Campaign administrators to add all domains currently referenced in deliveries through Control Panel and complete the work by September 5, 2026 to avoid delivery impact.
This is not just a security housekeeping item. Recurring deliveries, reusable templates, hosted assets, attachment links and older campaign workflows can all carry external URLs that are easy to miss if teams only check active campaigns scheduled for the next send.
APSB26-134 makes Adobe Campaign Classic build 9401 a Priority 1 security upgrade
Adobe’s APSB26-134 security bulletin identifies Adobe Campaign Classic v7 7.4.4 build 9400 and earlier on Windows and Linux as affected, with build 9401 listed as the updated version. The bulletin applies to fully on-premise deployments and the on-premise components of hybrid deployments, while Adobe-hosted instances have already been remediated.
The bulletin lists three critical vulnerabilities: CVE-2026-76197 and CVE-2026-76195 for OS command injection, and CVE-2026-76193 for server-side request forgery. Each is scored CVSS 10.0 and each can result in arbitrary code execution, which is why build 9401 is more than a routine point release.
Independent CVE records verify the Adobe Campaign Classic risk
Tenable’s CVE-2026-76197 record also lists the command injection flaw as critical, with a CVSS v3 score of 10.0 and source data from MITRE and NVD. That independent listing reinforces the severity of the build 9401 update beyond Adobe’s own release documentation.
The OpenCVE record for CVE-2026-76193 similarly shows Adobe Campaign Classic affected through 7.4.4 build 9400 and 7.4.4 build 9401 as unaffected. It also labels the SSRF flaw as critical, network reachable, low complexity and requiring no user interaction.
On-premise Adobe Campaign Classic estates face the immediate exposure
The near-term impact is narrow but serious. Fully Adobe-hosted Campaign Classic customers have no action from the security bulletin, but self-managed servers and hybrid components still need the 9401 upgrade, service restart and allow list review.
The operational risk is that these workstreams can be split across different owners. Security teams may track APSB26-134 as a patching issue, while Campaign administrators handle URL permissions in Control Panel. Because the September 5 deadline is tied to delivery content and attachments, both checks need to land before campaign execution is treated as normal.
Share With Others
Platinum
