Adobe Campaign Classic update closes eight critical flaws
Adobe Campaign Classic has received a security update for eight critical vulnerabilities affecting version 7.4.4 build 9402 and earlier on Windows and Linux. Adobe fixed the issues in version 7.4.4 build 9403. Successful exploitation could allow arbitrary code execution, meaning an attacker could make the affected system run commands or software, as well as bypass security features or gain higher privileges.
Three of the vulnerabilities carry a Common Vulnerability Scoring System (CVSS) rating of 9.9 out of 10. CVE-2026-104351 is a code injection flaw that could result in arbitrary code execution. Code injection occurs when a system treats untrusted input as instructions to run. CVE-2026-104353 is an operating system code injection vulnerability with the same potential outcome. CVE-2026-105780 is an incorrect authorization issue, meaning the software may fail to check properly whether someone is allowed to perform an action, which could also lead to arbitrary code execution.
Four of the remaining Campaign Classic flaws are SQL injection vulnerabilities. SQL injection involves specially constructed input being interpreted as database commands rather than ordinary data. CVE-2026-105489 has a CVSS score of 9.9, while CVE-2026-105781 is rated 9.8. CVE-2026-104354 and CVE-2026-105779 each have a score of 9.1. Adobe states that exploitation of any of these four issues could bypass security features.
The eighth Campaign Classic vulnerability, CVE-2026-104350, is a reflected cross-site scripting flaw rated 9.3. Cross-site scripting allows crafted content to be handled by a web interface in a way that can cause unintended code to run in a user's browser. In this case, Adobe says successful exploitation could produce privilege escalation, which means gaining access beyond the level originally granted to an account or user.
The concentration of high CVSS scores makes the Campaign Classic update important for businesses and IT teams running affected installations. The potential consequences span command execution, authorization failures, database manipulation and elevated access. Administrators should first establish which Campaign Classic build is installed on each Windows or Linux system, then move any installation on build 9402 or earlier to build 9403.
Adobe also addressed a separate critical code injection vulnerability in Adobe Connect Desktop and Mobile. Tracked as CVE-2026-48360 and rated 9.6, the flaw could lead to arbitrary code execution on Windows, macOS and Android. The fixed releases are Adobe Connect Desktop version 2026.9.61 for Windows, version 2026.10.66 for macOS Silicon and version 2026.10.170 for macOS Intel. Adobe Connect Mobile for Android has been fixed in version 4.5.
Selecting the correct Connect release matters because Adobe lists different fixed versions for Windows, the two macOS processor platforms and Android. Users and administrators should check both the operating system and the currently installed application version before confirming that an update has been completed. Campaign Classic requires its own separate upgrade to version 7.4.4 build 9403.
Adobe said it was not aware of any exploitation in the wild for the vulnerabilities covered by these updates. That means the company had no known evidence of real-world attacks using these flaws when it issued the fixes, not that affected installations can safely remain unpatched. The recommended action is to install the latest available version.
For organisations that need support managing security-sensitive systems, AEU-I provides security-first IT, infrastructure and consulting. Regardless of who manages the environment, businesses should record the installed builds, complete the relevant updates and verify afterward that the patched versions are running.