Adobe Campaign Classic: eight critical flaws, three could let attackers run cod…

What happened

On October 27, 2026, Adobe published security bulletin APSB26-162 for Adobe Campaign Classic (ACC), a platform for running marketing campaigns, bulk email and customer databases. The update fixes eight vulnerabilities, all of which Adobe rates as critical.

According to Adobe, the flaws could lead to arbitrary code execution, security feature bypass and privilege escalation. They include four SQL injection bugs, a code injection bug, an operating system command injection bug, an incorrect authorization bug and a reflected cross-site scripting (XSS) bug.

Adobe says it is not aware of any exploits in the wild for these issues. CVE-2026-104351, CVE-2026-104353, CVE-2026-105780 and CVE-2026-105781 are not listed in the CISA KEV catalog, and ENISA’s European Vulnerability Database (EUVD) does not mark them as exploited. Adobe gave the update priority 2 and recommends updating to the newest version. The Hacker News reported on the fixes a day later.

Why it is dangerous

The most serious are three flaws that Adobe says allow arbitrary code execution on the server: CVE-2026-104351, CVE-2026-104353 and CVE-2026-105780. The code would run with the privileges of the current user. The CVSS rating assumes high impact on confidentiality, integrity and availability. These flaws require a login, but a low-privileged account is enough. The attack works over the network with no user interaction.

CVE-2026-105781 stands out: it is an SQL injection flaw that, according to Adobe’s rating, needs no login at all. Picture a form where you type a database instruction instead of your name, and the system obediently runs it. The CVE record description published by Adobe says an attacker could run arbitrary SQL commands and gain elevated access or control over the victim’s account or session. The same description also mentions possible code execution, while the bulletin lists security feature bypass as the impact.

CVSS is a severity scale from 0 to 10. In the CVE record, Adobe scored CVE-2026-105781 at 10.0 (CVSS 3.1), while its bulletin lists 9.8. The code execution flaws score 9.9 from Adobe. All fall into the top “critical” band.

EPSS estimates the likelihood of exploitation within the next 30 days. As of October 28, 2026, it is highest for CVE-2026-104353 at 1.3%, and around 0.5% for the other three flaws mentioned above. They are not in CISA KEV, the US agency’s list of flaws confirmed as exploited. Low numbers do not mean the patch can wait.

Who is affected

According to Adobe, these versions are vulnerable:

Adobe Campaign Classic v7: 7.4.4 build 9402 and earlier, on both Windows and Linux

Campaign Classic is used mainly by larger companies, online retailers and marketing agencies for bulk email, SMS campaigns and customer data management. It runs either on the company’s own servers or in an environment managed by Adobe. Some components are usually reachable from the internet, such as click tracking, web forms or access for the operator console.

If you do not use Campaign Classic, you are affected at most indirectly, for example through an agency that processes your customers in this system. Bulletin APSB26-162 does not list other Adobe Campaign products. The Hacker News notes that Adobe also released a separate fix for Adobe Connect at the same time, but that is unrelated to this issue.

How to check if you are affected

You can find the version and build number in several ways that change nothing on the server:

In the Campaign Classic client console, open Help > About and look at the build number.
On the application server, run nlserver pdump as the Campaign service user (usually neolane on Linux). The version and build appear at the top of the output.
The test address /r/test on the Campaign server returns a short XML response whose build attribute shows the build number.

nlserver pdump

curl -s https://campaign.your-company.com/r/test

If the build is 9402 or lower, you are vulnerable. Build 9403 contains the fix. If Adobe or a partner runs your instance, ask for written confirmation of which build it is on.

How to fix it

The fixed version is Adobe Campaign Classic v7 7.4.4 build 9403 for Windows and Linux. Adobe recommends updating to the newest version. The vendor does not list a workaround that avoids updating.

List all instances and their builds, including test and auxiliary servers such as click tracking servers.
Start with internet-facing servers, because CVE-2026-105781 requires no login.
Back up the database and configuration files before updating and schedule a maintenance window.
Follow Adobe’s release notes and installation instructions for build 9403, ideally on a test environment first.
After the server update, also update operators’ client consoles and confirm the build with nlserver pdump.
For instances managed by Adobe, contact Adobe support and ask when the fix will be deployed.

Until the fix is in place, restrict access to the Campaign console and web services to VPN or known IP addresses. Review the operator list and remove unneeded accounts, since several flaws can be exploited with an ordinary account. These are general measures, not an official Adobe workaround.

What if you may already be compromised

Adobe has not published any indicators of compromise and is not aware of exploitation. Still, if your server was reachable from the internet, it is worth checking:

web server logs and nlserver logs for unusual requests, database errors or many failed logins
new or unknown operator accounts and unexpected permission changes
workflows, scripts and templates that nobody on your team changed
unknown files and processes running as the Campaign service user, and unusual outbound connections
unexpected exports of customer data

If you find anything suspicious, disconnect the server from the network, keep the logs and bring in an incident response specialist. If personal data may have leaked, GDPR may require you to notify the supervisory authority within 72 hours.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

Adobe Campaign Classic: eight critical flaws, three could let attackers run code on the server