Adobe Campaign Classic patch fixes eight critical flaws up to CVSS 9.9

Adobe Campaign Classic patch fixes eight critical flaws up to CVSS 9.9

27 October 2026: Adobe has fixed eight critical vulnerabilities in Campaign Classic v7, its on-premises and hosted marketing campaign platform, in bulletin APSB26-162. Four score 9.9 and can lead to code execution or a security bypass for any user with a low-privileged account; one SQL injection, scored 9.8, needs no account at all. The fix is ACC v7 7.4.4 build 9403. Adobe says it is not aware of any of the flaws being exploited.

The eight flaws

Every version up to 7.4.4 build 9402 on Windows and Linux is affected.

• CVE-2026-104351, code injection, CVSS 9.9: arbitrary code execution.
• CVE-2026-104353, OS command injection, CVSS 9.9: arbitrary code execution.
• CVE-2026-105780, incorrect authorisation, CVSS 9.9: arbitrary code execution.
• CVE-2026-105489, SQL injection, CVSS 9.9: security feature bypass.
• CVE-2026-105781, SQL injection, CVSS 9.8: security feature bypass, with no privileges required.
• CVE-2026-104350, reflected cross-site scripting, CVSS 9.3: privilege escalation if a user opens a crafted link.
• CVE-2026-104354, SQL injection, CVSS 9.1: needs a high-privileged account.
• CVE-2026-105779, SQL injection, CVSS 9.1: security feature bypass.

The four 9.9 issues share a vector with a changed scope, meaning a successful attack reaches beyond the vulnerable component. NVD published the records on the same day, with Adobe as the source.

Why Campaign servers deserve a quick window

Campaign Classic holds customer lists, segments and the credentials it uses to send email and messages, and it is often reachable from the internet so marketing staff and partners can log in. A low-privileged account is a modest bar: agencies, contractors and junior marketers usually have one. The SQL injection that needs no login lowers the bar further.

Adobe rates the update priority 2, its middle rating, which it uses for products that have been targeted in the past without a current known exploit, and suggests installing within about 30 days. Given the scores, teams running their own Campaign servers may want to move faster than that.

Installing build 9403

The update is installed from the release notes Adobe links in the bulletin. Customers on Adobe's managed hosting should check with Adobe whether their instance has already been upgraded. After installing, a review of which accounts can log in to the Campaign console, and whether the server needs to be reachable from the internet at all, narrows the exposure left by any flaw found later.

We list Adobe as a company. Our marketing automation software category lists eight products.

Sources

• Adobe Security Bulletin APSB26-162: Security update available for Adobe Campaign Classic, 27 October 2026
• NVD: CVE-2026-104351, 27 October 2026