Adobe has released urgent fixes for eight critical vulnerabilities in its Campaign Classic platform, addressing flaws that, if exploited, could allow attackers to run code remotely, bypass security controls, or escalate privileges. These issues affect Windows and Linux installations of Campaign Classic versions 7.4.4 build 9402 and earlier; the patch updates to version 7.4.4 build 9403. The severity of many of these vulnerabilities is extremely high, with CVSS scores ranging from 9.1 to 9.9. ===
Main Vulnerabilities in Adobe Campaign Classic
The roster of eight CVEs includes several that enable arbitrary code execution through different attack vectors:
- CVE-2026-104351, CVE-2026-104353 – Code injection vulnerabilities that allow running malicious code.
- CVE-2026-105780 – An incorrect authorization vulnerability also capable of leading to arbitrary code execution.
- CVE-2026-105489, CVE-2026-105781, CVE-2026-104354, CVE-2026-105779 – SQL injection flaws that could enable attacks like bypassing security defenses.
- CVE-2026-104350 – A reflected cross-site scripting issue that could lead to privilege escalation.
All but one of the SQL injection bugs and the XSS issue carry CVSS ratings above 9.0, highlighting how critical these loopholes are for organizations using Campaign Classic. These flaws could allow malicious actors to move freely through affected systems if unpatched.
Other Adobe Fixes & Recommendations
Adobe also addressed a separate, highly critical vulnerability in its Connect product line—specifically in Adobe Connect Desktop and Mobile. This code injection flaw (CVE-2026-48360, CVSS 9.6) impacts Windows, macOS (both Intel and Silicon), and Android versions of Connect. Patched versions are now available for users on these platforms.
The software maker states it is not aware of any exploit activity in the wild targeting any of the patched vulnerabilities. Nonetheless, it strongly urges users to upgrade to the fixed releases immediately to guard against potential attackers scanning for these flaws.
Users running Campaign Classic should check whether their deployment is on version 7.4.4 build 9402 or earlier. If so, applying the update to build 9403 is critical. Similarly, those using Adobe Connect should verify they’ve installed the latest desktop and mobile builds for their respective operating systems.
This alert underscores a recurring theme in software security: systems entrusted with sensitive or large-scale operations continue to suffer from injection and authorization flaws. Adobe once again serves as a reminder that regular updates and patch management aren’t optional—they’re foundational to defending against increasingly potent threats.
What this means: These patches should be viewed as emergency fixes. Attackers routinely use SQL injections, unauthorized access bugs, and code execution flaws to breach systems. Even though none of the issues are yet reported in the wild, the high CVSS scores and seriousness of the vulnerabilities demand swift action. Keep an eye out for security bulletin updates from Adobe, audit your deployment versions, and treat this patching round as a top priority. Organizations slow to respond may find themselves exposed.
