Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation.
The list of eight vulnerabilities is as follows -
- CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution.
- CVE-2026-104353 (CVSS score: 9.9) - An operating system code injection vulnerability that could lead to arbitrary code execution.
- CVE-2026-105780 (CVSS score: 9.9) - An incorrect authorization vulnerability that could lead to arbitrary code execution.
- CVE-2026-105489 (CVSS score: 9.9) - An SQL injection vulnerability that could lead to security feature bypass.
- CVE-2026-105781 (CVSS score: 9.8) - An SQL injection vulnerability that could lead to security feature bypass.
- CVE-2026-104350 (CVSS score: 9.3) - A reflected cross-site scripting vulnerability that could lead to privilege escalation.
- CVE-2026-104354 (CVSS score: 9.1) - An SQL injection vulnerability that could lead to security feature bypass.
- CVE-2026-105779 (CVSS score: 9.1) - An SQL injection vulnerability that could lead to security feature bypass.
The issues affect Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux. They have been patched in version 7.4.4 build 9403.
Also resolved by Adobe is a critical code injection flaw in Adobe Connect Desktop and Mobile for Windows, macOS, and Android (CVE-2026-48360, CVSS score: 9.6) that could result in arbitrary code execution.
The vulnerability has been fixed in the following versions -
-
Adobe Connect Desktop -
- Windows: version 2026.9.61
- macOS Silicon: version 2026.10.66
- macOS Intel: version 2026.10.170
- Adobe Connect Mobile for Android version 4.5
Adobe said it's not "aware of any exploits in the wild for any of the issues" addressed in the update. Users are advised to update to the latest version for optimal protection.