Adobe patches eight critical Campaign Classic flaws including CVSS 9.9 code injection

Adobe patched eight critical vulnerabilities in Adobe Campaign Classic on Oct. 27, 2026, including four CVSS 9.9 flaws, affecting version 7.4.4 build 9402 and earlier on Windows and Linux.

Adobe published two security bulletins on Oct. 27, 2026 addressing nine vulnerabilities across Campaign Classic and Connect. The bulletins covered Campaign Classic and Adobe Connect client software.

The flaws could allow arbitrary code execution, security feature bypass, or privilege escalation if exploited. Four of the eight carry a CVSS score of 9.9. These include CVE-2026-104351, a code injection vulnerability that could lead to arbitrary code execution; CVE-2026-104353, an operating system code injection vulnerability that could lead to arbitrary code execution; CVE-2026-105780, an incorrect authorization vulnerability that could lead to arbitrary code execution; and CVE-2026-105489, an SQL injection vulnerability that could lead to security feature bypass.

CVE-2026-105781 is an SQL injection vulnerability rated CVSS 9.8 that could lead to security feature bypass. The Hacker News and LavX News list that score, while all-about-security.de rates the same flaw at CVSS 10.0. CVE-2026-104350 is a reflected cross-site scripting vulnerability rated CVSS 9.3 that could lead to privilege escalation. CVE-2026-104354 and CVE-2026-105779 are SQL injection vulnerabilities rated CVSS 9.1 that could lead to security feature bypass.

“Adobe said it is not aware of exploits in the wild for any of the issues addressed in the update.” all-about-security.de states no confirmed attacks and no public proof-of-concept code exist for any of the nine flaws across Campaign Classic and Connect.

Adobe also patched a separate critical code injection flaw in Adobe Connect client software, CVE-2026-48360, rated CVSS 9.6, that may allow arbitrary code execution. The patched version of Adobe Connect Desktop for Windows is 2026.9.61, for macOS Silicon is 2026.10.66, and for macOS Intel is 2026.10.170. Adobe patched Adobe Connect Mobile for Android at version 4.5.

all-about-security.de lists Adobe Connect Desktop for Windows v2026.8.51 and earlier as affected. It lists Adobe Connect Desktop for macOS Silicon v2026.08.45 and earlier as affected, and Adobe Connect Desktop for macOS Intel v2026.01.39 and earlier as affected. The outlet also lists Adobe Connect Mobile for Android version 4.4 and earlier as affected.

Enterprises use Campaign Classic for high-volume e-mail and cross-channel marketing, and it stores subscriber lists, campaign templates, and delivery logs. LavX News states an injection hole in Campaign Classic is a direct route to customer data.

CVE-2026-105780 lets a low-privilege user gain administrator-level access, and Adobe assigns full code execution impact to the authorization flaw. CVE-2026-104350 executes script in a victim’s browser when the victim opens a crafted link. The realistic attack path for that flaw targets a campaign operator through a phishing message.

Adobe patched Campaign Classic in version 7.4.4 build 9403. LavX News advises administrators to patch Campaign Classic to build 9403 and to update Connect clients through mobile device management. The outlet also advises auditing internet-facing exposure and placing Campaign administration consoles behind a VPN or allowlist.

LavX News advises reviewing privilege assignments and audit logs for unexpected configuration changes because of the authorization flaw. It also advises briefing marketing staff about targeted messages before the fix reaches every machine because of the reflected XSS flaw. The Hacker News recommends updating to the latest version for optimal protection.

all-about-security.de states the updates carry priority level 2. The outlet advises administrators to apply updates promptly. Starting Aug. 11, 2026, Adobe may assign one CVE identifier to internally discovered vulnerabilities sharing a severity rating and CWE category. The policy applies to releases with systemic fixes.

Adobe issued critical security update APSB26-120 for Adobe Campaign Classic on Aug. 3, 2026, and rated it as priority 1. The August update affected Campaign Classic ACC v7.4.3 build 9398 and earlier, and build 9399 was the fix. It listed CVE-2026-48331, an unauthenticated remote server-side request forgery vulnerability rated CVSS 10.0; CVE-2026-48323, an unauthenticated remote template engine injection vulnerability rated CVSS 10.0; and CVE-2026-48330, an unauthenticated remote SQL injection vulnerability rated CVSS 10.0. Adobe was not aware of exploits targeting the August 2026 vulnerabilities in the wild.

The August 2026 bulletin applies to on-premise and hybrid deployments. Adobe-hosted instances were already remediated.