Adobe has released fixes for eight critical vulnerabilities in Adobe Campaign Classic, its marketing-automation platform, according to The Hacker News. Three carry a CVSS score of 9.9 and can lead to arbitrary code execution: CVE-2026-104351 (code injection), CVE-2026-104353 (operating-system code injection) and CVE-2026-105780 (incorrect authorization). A fourth 9.9 flaw, CVE-2026-105489, is an SQL injection that can bypass security features. The rest are SQL injection bugs rated CVE-2026-105781 (9.8), CVE-2026-104354 (9.1) and CVE-2026-105779 (9.1), plus a reflected cross-site scripting flaw, CVE-2026-104350 (9.3), that can lead to privilege escalation.
The same Adobe update round also fixes a critical code injection flaw in Adobe Connect Desktop and Mobile, CVE-2026-48360 (CVSS 9.6), which could allow arbitrary code execution. Adobe says it is not aware of any exploits in the wild for any of these issues. Administrators should still treat code-execution flaws with scores this high as patch-soon items even without known attacks. This is separate from the Campaign Classic flaw covered earlier this year in our August report.
How to check if you’re affected
Affected versions of Adobe Campaign Classic are 7.4.4 build 9402 and earlier on Windows and Linux; the fix is version 7.4.4 build 9403, per The Hacker News. Check the build number your Campaign Classic servers report and plan the upgrade to build 9403 or later, then confirm against Adobe’s bulletin APSB26-162.
- Adobe Connect: the affected products are Adobe Connect Desktop (Windows, macOS) and Adobe Connect Mobile for Android. The fixed versions listed are Desktop 2026.9.61 on Windows, 2026.10.66 on macOS Silicon, 2026.10.170 on macOS Intel, and Mobile 4.5 on Android. Compare against Adobe’s bulletin APSB26-182.
- Hosted customers: the sources do not say whether Adobe-hosted Campaign deployments are patched for you; ask your Adobe contact.
Sources
- Adobe security bulletin APSB26-162 (Campaign Classic) (returned access-denied to our automated checks; details above are as reported by The Hacker News)
- Adobe security bulletin APSB26-182 (Connect) (same note)
- The Hacker News: Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass