Adobe — Eight Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass Fixed (CVE-2026-104351)

Publication date: October 28, 2026
Category: News / Web Security

Introduction

Adobe has released a high-priority security advisory addressing a collection of eight critical vulnerabilities impacting its enterprise marketing platform, Adobe Campaign Classic. If successfully exploited by malicious actors, these vulnerabilities can enable arbitrary code execution, security feature bypass, and privilege escalation across affected corporate environments. The formal investigation and reporting of these flaws have prompted the vendor to issue official patches through security bulletin APSB26-162, mitigating vectors that threaten both the integrity and confidentiality of enterprise servers.

What is Adobe Campaign Classic and the Nature of the Risk? (General Analysis)

Adobe Campaign Classic (ACC) is an omnichannel marketing campaign management solution tailored for large enterprises, enabling the automation of marketing workflows, customer databases, and mass communications. Given its deep integration with relational database management systems and exposure within web infrastructures, any security flaw within its architecture serves as an ideal entry point for attackers seeking a pivot into an organization’s internal network.

The eight fixed vulnerabilities span multiple software weakness categories officially recorded in the National Vulnerability Database (NVD). Confirmed severity details and vector classifications are outlined below, emphasizing that most vectors do not require user interaction under low privileges (PR:L).

How Does It Work? (Technical Analysis)

An analysis of the vulnerability collection reveals a recurring pattern of weaknesses concerning input validation, access control, and dynamic code generation within the Adobe Campaign Classic architecture.

  • Initial Entry Flow and Injection Vectors: Low-privileged attackers can leverage code generation control weaknesses (CWE-94), operating system command injection (CWE-78), and SQL injection flaws (CWE-89) via manipulated HTTP requests sent directly to vulnerable ACC server endpoints.
  • Execution and Control Bypass: Vulnerabilities such as CVE-2026-105781 allow unauthenticated (PR:N) execution of SQL commands, granting attackers the ability to manipulate underlying queries to gain elevated access. Additionally, incorrect authorization flaws (CWE-863, such as CVE-2026-105780) permit the circumvention of application logic restrictions.
  • Client-Side Exploitation (Reflected XSS): Vector CVE-2026-104350 introduces a reflected Cross-Site Scripting scenario (CWE-79) requiring user interaction (visiting a crafted URL), facilitating privilege escalation via administrative session hijacking.

Affected Systems / Environments

The vulnerabilities directly impact Adobe Campaign Classic versions 7.4.4 build 9402 and earlier deployed across Windows and Linux platforms. Additionally, Adobe has resolved an independent critical code injection flaw in Adobe Connect Desktop and Mobile (tracked as CVE-2026-48360, with a CVSS score of 9.6) for Windows, macOS, and Android.

CVE Category (CWE) Impact CVSS Vector (Summary)
CVE-2026-104351 CWE-94 (Code Injection) Code Execution 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-104353 CWE-78 (OS Command Injection) Code Execution 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-105780 CWE-863 (Incorrect Authorization) Code Execution 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-105489 CWE-89 (SQL Injection) Code Execution 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-105781 CWE-89 (SQL Injection) Security Bypass 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-104350 CWE-79 (Reflected XSS) Privilege Escalation 9.3 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVE-2026-104354 CWE-89 (SQL Injection) Security Bypass 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2026-105779 CWE-89 (SQL Injection) Security Bypass 9.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Mitigation and Detection

Remediation

System administrators and infrastructure teams must immediately apply the patches provided by the vendor:

  • Adobe Campaign Classic: Update to version 7.4.4 build 9403 on both Windows and Linux environments.
  • Adobe Connect Desktop: Update to version 2026.9.61 on Windows, version 2026.10.66 on macOS Silicon, version 2026.10.170 on macOS Intel, and version 4.5 for Android.

Detection

Blue Teams should audit web access logs and database audit trails for anomalous SQL query patterns, command injection strings, or suspicious HTTP requests targeting Campaign Classic components.

Threat Intelligence Advisory: The presence of multiple critical remote code execution vulnerabilities requiring no user interaction dramatically increases the risk of automated exploitation. Perimeter network isolation is recommended while patches are being applied.

Wrapping Up

The disclosure and rapid patching of this batch of eight critical vulnerabilities in Adobe Campaign Classic highlights the complexity of securing enterprise platforms deeply integrated with databases and dynamic execution engines. Although the vendor reports no active exploitation in the wild at this time, the technical severity of these flaws —reaching CVSS scores as high as 10.0— demands immediate remediation by system administrators to prevent catastrophic security breaches.

References