Adobe Campaign Classic Patch Addresses Eight Critical Flaws
Adobe released a security update on 28 October 2026 that closes eight high-severity vulnerabilities in Campaign Classic. The flaws, identified as CVE-2026-104351, CVE-2026-104353, CVE-2026-105780, CVE-2026-105489, CVE-2026-105781, CVE-2026-104350, CVE-2026-104354, and CVE-2026-105779, could enable attackers to execute arbitrary code, bypass security controls, or elevate privileges.
Attack Vectors and Impact
The vulnerabilities span several categories:
- Code injection (CVE-2026-104351, CVE-2026-104353) allows an attacker to inject and run code on the host operating system.
- Incorrect authorization (CVE-2026-105780) permits execution of privileged actions without proper checks.
- SQL injection (CVE-2026-105489, CVE-2026-105781, CVE-2026-104354, CVE-2026-105779) can lead to data exfiltration or manipulation and bypass security features.
- Cross-site scripting (CVE-2026-104350) enables privilege escalation through reflected XSS. All eight flaws share a CVSS score of 9.9 or higher, indicating a high likelihood of exploitation if left unpatched.
Affected Environments
The flaws affect Adobe Campaign Classic versions 7.4.4 build 9402 and earlier on both Windows and Linux platforms. The patch is delivered in version 7.4.4 build 9403. Administrators should verify the build number in the application’s About dialog or via the command line before applying the update.
Patch Details and Deployment
Adobe’s advisory lists the exact build numbers and operating systems. The update can be downloaded from the Adobe Security Portal and applied using the standard installer or via the command line for Linux. After installation, a system restart is recommended to ensure all services reload with the new binaries.
Additional Adobe Connect Fix
Alongside Campaign Classic, Adobe addressed a critical code injection flaw in Adobe Connect Desktop and Mobile (CVE-2026-48360). The fix applies to Windows (2026.9.61), macOS Silicon (2026.10.66), macOS Intel (2026.10.170), and Android (4.5). Users of Connect should update to these versions immediately.
Verification and Logging
Post-patch, verify that the application reports the new build number. Enable audit logging for authentication and privilege changes to detect any anomalous activity. If an organization uses custom plugins or extensions, test them against the new build to confirm compatibility.
Mitigation Guidance
- Apply the patch: Download and install 7.4.4 build 9403 for Campaign Classic and the corresponding Connect updates.
- Validate build numbers: Confirm the application reports the patched build.
- Review access controls: Ensure that role-based permissions are correctly configured, especially for users with elevated privileges.
- Enable logging: Turn on detailed audit logs for authentication, authorization, and database queries.
- Monitor for anomalies: Watch for unexpected SQL queries, failed login attempts, or privilege escalation events.
What to Watch Next
Adobe’s rapid patch cycle for these vulnerabilities suggests a broader review of input validation and authorization logic across the product line. Security teams should audit other Adobe products for similar patterns and consider implementing runtime application self-defence (RASP) to detect injection attempts.
Related Resources
For a deeper dive into the CVE landscape, see the Zero-Day Vulnerability & CVE Exploit Matrix.
Related coverage
- PHP2Shell RCE Exploits Force Immediate Patch for Millions of Sites
- Tailscale Releases Urgent Patches After Uncoordinated Disclosure of Tailworm Vulnerabilities