Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Adobe Patches Eight Critical Campaign Classic Flaws Enabling Code Execution

Eight critical vulnerabilities in Adobe Campaign Classic, four of them rated CVSS 9.9, allow arbitrary code execution, security bypass and privilege escalation. A separate critical flaw in Adobe Connect was fixed as well.

4T4Tify Team4Tify
Oct 28, 2026·4 min read
Adobe Patches Eight Critical Campaign Classic Flaws Enabling Code Execution

Adobe Patches Eight Critical Campaign Classic Flaws Enabling Code Execution

Adobe has shipped a security update for Campaign Classic that closes eight critical vulnerabilities. The most severe of them allow an attacker to run arbitrary code on the server, bypass security controls or escalate privileges inside the marketing platform. A ninth critical flaw, in Adobe Connect, was fixed in the same release cycle.

What was fixed

All eight Campaign Classic issues carry a CVSS score above 9.0:

  • CVE-2026-104351 (CVSS 9.9): code injection leading to arbitrary code execution
  • CVE-2026-104353 (CVSS 9.9): OS command injection leading to arbitrary code execution
  • CVE-2026-105780 (CVSS 9.9): incorrect authorization leading to arbitrary code execution
  • CVE-2026-105489 (CVSS 9.9): SQL injection leading to security feature bypass
  • CVE-2026-105781 (CVSS 9.8): SQL injection leading to security feature bypass
  • CVE-2026-104350 (CVSS 9.3): reflected cross-site scripting leading to privilege escalation
  • CVE-2026-104354 (CVSS 9.1): SQL injection leading to security feature bypass
  • CVE-2026-105779 (CVSS 9.1): SQL injection leading to security feature bypass

The flaws affect Adobe Campaign Classic 7.4.4 build 9402 and earlier on both Windows and Linux. The fix ships as build 9403 of version 7.4.4.

Adobe also resolved CVE-2026-48360 (CVSS 9.6), a code injection vulnerability in Adobe Connect Desktop and Mobile that could result in arbitrary code execution. Patched versions are:

  • Adobe Connect Desktop for Windows: 2026.9.61
  • Adobe Connect Desktop for macOS (Apple Silicon): 2026.10.66
  • Adobe Connect Desktop for macOS (Intel): 2026.10.170
  • Adobe Connect Mobile for Android: 4.5

Adobe states that it is not aware of any in-the-wild exploitation of these issues at the time of publication.

Why it matters

Campaign Classic is a marketing automation platform. It stores customer records, consent data and campaign content, and it is frequently integrated with CRM, e-commerce and data warehouse systems. A server-side code execution flaw in it is therefore not just a problem for the marketing team: it opens a path to large volumes of personal data and to the connected systems behind it.

Four of the eight vulnerabilities are SQL injection bugs. Several injection flaws in a single product usually mean the same code base contains multiple unsanitised inputs, so it is reasonable to assume attackers will study the patch diff quickly. "No known exploitation" today is not a reason to postpone the update.

Adobe Connect carries a different risk profile: client-side code execution on employee laptops and phones. In a phishing scenario, a malicious meeting link or file is enough to turn a conferencing app into an initial-access vector.

What to do

  1. Upgrade Campaign Classic to 7.4.4 build 9403 on every instance, including the staging and disaster-recovery servers that are often forgotten.
  2. Update Adobe Connect clients to the versions above and push them through your endpoint management tooling rather than relying on users to self-update.
  3. Check exposure. Campaign Classic consoles and web endpoints should not be reachable from the public internet. If they are, restrict access by VPN or IP allow-list while you patch.
  4. Review logs on Campaign Classic servers for unusual SQL errors, unexpected OS commands or new administrator accounts created around the disclosure window.
  5. Inventory third-party-managed marketing platforms. Many organisations run these systems through agencies or partners. Confirm who owns the patching obligation.

Flaws like these are rarely exploited on day one, but they are exactly the kind of issue that lingers unpatched on an internal server for months. Regular vulnerability scanning of both internet-facing and internal assets is how our team catches outdated Campaign Classic builds and similar corporate software before an attacker does.

SHARE