Adobe patches eight critical Campaign Classic flaws enabling code execution and security bypass
Adobe released fixes for eight critical Campaign Classic vulnerabilities, four of them scored CVSS 9.9, that could allow code execution, security bypass, or privilege escalation.
At a glance
- Adobe's advisory APSB26-162 addresses eight critical flaws in Campaign Classic, with CVSS scores from 9.1 to 9.9.
- The flaws could lead to arbitrary code execution, security feature bypass, or privilege escalation.
- Affected: Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux; fixed in build 9403.
- The same update round also fixed a critical code injection flaw (CVE-2026-48360) in Adobe Connect; Adobe said it is not aware of exploitation.
Adobe has released security updates for eight critical vulnerabilities in Campaign Classic, its enterprise marketing campaign management platform, The Hacker News reported on October 28, 2026. According to the report, which points to Adobe's advisory APSB26-162, exploitation of the flaws could result in arbitrary code execution, security feature bypass, and privilege escalation.
What happened
The Hacker News says all eight flaws are rated critical, with CVSS scores ranging from 9.1 to 9.9. Four of them carry the top 9.9 score: two code injection bugs (CVE-2026-104351 and CVE-2026-104353) and an incorrect authorization flaw (CVE-2026-105780) that can each lead to arbitrary code execution, plus a SQL injection flaw (CVE-2026-105489) that can enable a security feature bypass. The remaining issues are an additional SQL injection flaw scored 9.8 (CVE-2026-105781), a reflected cross-site scripting flaw at 9.3 (CVE-2026-104350) that can allow privilege escalation, and two more SQL injection flaws at 9.1 (CVE-2026-104354 and CVE-2026-105779). In all, the report counts three issues that could lead to code execution, four to security bypass, and one to privilege escalation.
Who is affected
According to The Hacker News, the vulnerabilities affect Adobe Campaign Classic version 7.4.4 build 9402 and earlier on both Windows and Linux. Adobe addressed them in version 7.4.4 build 9403. The same update round also fixed a critical code injection flaw in Adobe Connect, tracked as CVE-2026-48360 (CVSS 9.6), affecting the Desktop and Mobile clients; fixed versions include Connect Desktop 2026.9.61 for Windows and Connect Mobile 4.5 for Android. Adobe said it is not aware of any exploits in the wild for any of the issues in the update.
What to do
The report advises customers to update to the latest versions for optimal protection. Given the four CVSS 9.9 code execution flaws, organizations should prioritize deploying Campaign Classic build 9403, especially on internet-facing or high-value systems, verify their installed build numbers against the affected list, update Adobe Connect Desktop and Mobile clients to the fixed releases, and review Adobe's APSB26-162 advisory directly for full technical details.
Related CVEs
Sources
This story is based on the sources listed above. Always check the vendor’s official advisory before acting on critical systems.
