On October 27, 2026, Adobe published security update APSB26-162, which addresses eight critical vulnerabilities in Adobe Campaign Classic — a marketing automation platform widely used by large organizations. All eight vulnerabilities received CVSS scores from 9.1 to 9.9 and allow arbitrary code execution, security bypass, or privilege escalation. Affected are ACC v7 7.4.4 build 9402 and earlier on Windows and Linux. The fix is available in build 9403. At the same time, Adobe closed a critical vulnerability in Adobe Connect. According to Adobe, no exploitation in the wild has been observed.
Details of the Campaign Classic vulnerabilities
The eight vulnerabilities fall into four different classes, which points to systemic issues across several product components:
Code and OS command injection (arbitrary code execution):
- CVE-2026-104351 (CVSS 9.9) — code injection (CWE-94), requires low privileges, network attack vector
- CVE-2026-104353 (CVSS 9.9) — OS command injection (CWE-78), requires low privileges, network attack vector
Improper authorization (arbitrary code execution):
- CVE-2026-105780 (CVSS 9.9) — authorization error (CWE-863), requires low privileges, network attack vector
SQL injection (security bypass):
- CVE-2026-105489 (CVSS 9.9) — SQL injection (CWE-89)
- CVE-2026-105781 (CVSS 9.8) — SQL injection (CWE-89), does not require privileges
- CVE-2026-104354 (CVSS 9.1) — SQL injection (CWE-89)
- CVE-2026-105779 (CVSS 9.1) — SQL injection (CWE-89)
Cross-site scripting (privilege escalation):
- CVE-2026-104350 (CVSS 9.3) — reflected XSS (CWE-79)
Prioritization: not just by CVSS
The three vulnerabilities with the maximum score of 9.9 (CVE-2026-104351, CVE-2026-104353, CVE-2026-105780) require low privileges for exploitation. At the same time, CVE-2026-105781 with a score of 9.8 does not require any privileges at all — according to the CVSS vector published by Adobe (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). All four vulnerabilities use a network attack vector. This means that when prioritizing patches, you should consider not only the absolute CVSS value but also the privilege requirements: CVE-2026-105781 may pose a greater practical risk for Campaign Classic instances that are accessible over the network, precisely because the attacker does not need authentication.
Vulnerability in Adobe Connect
On the same day Adobe published advisory APSB26-182, which fixes the critical vulnerability CVE-2026-48360 (CVSS 9.6) in Adobe Connect Desktop and Mobile. This is a code injection vulnerability (CWE-94) that allows arbitrary code execution. Affected are:
- Adobe Connect Desktop for Windows — versions 2026.8.51 and earlier
- Adobe Connect Desktop for macOS Silicon — versions 2026.08.45 and earlier
- Adobe Connect Desktop for macOS Intel — versions 2026.01.39 and earlier
- Adobe Connect Mobile for Android — versions 4.4 and earlier
Fixed versions: Windows 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170, Android 4.5.
Two separate remediation tracks
This disclosure affects two fundamentally different remediation tracks: server installations of Campaign Classic on Windows and Linux, and Adobe Connect client software on Windows, macOS and Android. Administrators need to inventory both types of deployments — server and endpoint — to make sure remediation is complete.
Impact assessment
Adobe Campaign Classic is used to manage marketing campaigns and processes large volumes of customer data, including personal information. The combination of SQL injection enabling security bypass with vulnerabilities that lead to arbitrary code execution creates conditions for complete compromise of the server infrastructure. Four SQL injections out of eight vulnerabilities indicate issues with input validation across multiple product components.
According to Adobe, the company has no information about these vulnerabilities being exploited in the wild. No independent confirmation of this status was found in the CISA KEV catalog or the NVD database at the time of publication.
Recommendations
- Campaign Classic: update to ACC v7 7.4.4 build 9403 on all Windows and Linux servers
- Adobe Connect: update client applications to the fixed versions on all platforms (Windows, macOS, Android)
- Inventory all Campaign Classic instances and Adobe Connect installations in the organization — the two products require separate updates
- For Campaign Classic instances accessible from external networks, prioritize remediation of CVE-2026-105781 (does not require authentication) alongside the three vulnerabilities with a 9.9 score
- Until patches are applied, restrict network access to Campaign Classic servers using firewalling
We have previously covered critical vulnerabilities in this product — in particular, vulnerabilities with a CVSS score of 10.0 in Campaign Classic and ColdFusion, as well as a separate fix for a CVSS 10.0 vulnerability in Campaign Classic. The frequency with which critical vulnerabilities appear in this product underlines the need for prompt patch management for organizations using Campaign Classic.
Upgrading to build 9403 for Campaign Classic and to the fixed versions of Adobe Connect is the only reliable protective measure. Given that all eight Campaign Classic vulnerabilities have CVSS scores above 9.0 and use a network attack vector, delaying patch deployment is not recommended — especially for servers accessible from the internet.
