Adobe Patches Eight Critical Vulnerabilities in Campaign Classic
Adobe has released critical security updates for its Campaign Classic software, addressing eight flaws that could lead to code execution, security bypass, and privilege escalation.
Adobe has issued patches for a significant batch of eight critical vulnerabilities affecting its Campaign Classic marketing automation software. These flaws, if exploited, could allow attackers to achieve arbitrary code execution, bypass security measures, and escalate privileges on affected systems.
The vulnerabilities range in severity, with several carrying a CVSS score of 9.9, indicating a critical risk. Among the most severe is CVE-2026-104351, a code injection vulnerability that directly enables arbitrary code execution. Similarly, CVE-2026-104353 allows for operating system code injection, and CVE-2026-105780 presents an incorrect authorization flaw that can also lead to arbitrary code execution.
Further compounding the risk, several SQL injection vulnerabilities were also addressed. CVE-2026-105489, CVE-2026-105781, CVE-2026-104354, and CVE-2026-105779 all fall under the SQL injection category, with the potential to bypass security features. Additionally, a reflected cross-site scripting vulnerability, CVE-2026-104350, could be exploited for privilege escalation.
These critical issues specifically impact Adobe Campaign Classic versions 7.4.4 build 9402 and earlier, across both Windows and Linux operating systems. Adobe has resolved these vulnerabilities in version 7.4.4 build 9403, urging customers to update promptly.
In a separate advisory, Adobe also addressed a critical code injection flaw in Adobe Connect Desktop and Mobile applications. Identified as CVE-2026-48360 with a CVSS score of 9.6, this vulnerability could also result in arbitrary code execution on Windows, macOS, and Android devices. Patches for Connect include versions 2026.9.61 for Windows desktop, 2026.10.66 for macOS Silicon, 2026.10.170 for macOS Intel, and version 4.5 for Android mobile.
While Adobe stated it is not aware of any active exploits in the wild for these specific vulnerabilities, the high severity scores and potential impact necessitate immediate attention from users. The company strongly advises all customers to update to the latest patched versions to ensure optimal protection against potential threats.
This extensive patching effort underscores the ongoing challenges vendors face in securing complex software suites. The sheer number of critical vulnerabilities disclosed simultaneously highlights the importance of regular security audits and prompt remediation by both vendors and their customers to maintain a robust security posture.