Adobe Campaign Classic APSB26-162 and Adobe Connect APSB26-182: nine critical code execution and SQL injection flaws
Eight critical flaws in Campaign Classic 7.4.4 build 9402 and earlier allow code execution and SQL injection. Upgrade to build 9403 and update Connect clients.
- Published
- Updated
- CVE
- CVE-2026-104351
CVE-2026-104353
CVE-2026-105780
CVE-2026-105489
CVE-2026-105781
CVE-2026-104350
CVE-2026-104354
CVE-2026-105779
CVE-2026-48360 - Fixed in
- Campaign Classic 7.4.4 build 9403; Adobe Connect 2026.9.61 (Windows), 2026.10.66 (macOS Apple silicon), 2026.10.170 (macOS Intel), Android 4.5
- Exploitation
- No. Adobe says it is not aware of exploits in the wild; not in CISA KEV as of 30 October
Live scores
CVE-2026-104351- EPSS
- 0.006
low predicted chance of attack - VEDAS
- 0.057
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-104353- EPSS
- 0.013
some chance of attack soon - VEDAS
- 0.060
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-105780- EPSS
- 0.005
low predicted chance of attack - VEDAS
- 0.051
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-105489- EPSS
- 0.005
low predicted chance of attack - VEDAS
- 0.056
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-105781- EPSS
- 0.005
low predicted chance of attack - VEDAS
- 0.052
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-104350- EPSS
- 0.006
low predicted chance of attack - VEDAS
- 0.049
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-104354- EPSS
- 0.005
low predicted chance of attack - VEDAS
- 0.053
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-105779- EPSS
- 0.003
low predicted chance of attack - VEDAS
- 0.047
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Live scores
CVE-2026-48360- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.051
little exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
What happened
On 27 October 2026, Adobe published two bulletins.
APSB26-162, Adobe Campaign Classic. Eight critical flaws in Campaign Classic v7 7.4.4 build 9402 and earlier, on Windows and Linux, fixed in build 9403 (Adobe APSB26-162):
| CVE | Type | Impact (Adobe) | CVSS | Login needed |
|---|---|---|---|---|
| CVE-2026-104351 | Code injection | Code execution | 9.9 | Low-privileged user |
| CVE-2026-104353 | OS command injection | Code execution | 9.9 | Low-privileged user |
| CVE-2026-105780 | Incorrect authorization | Code execution | 9.9 | Low-privileged user |
| CVE-2026-105489 | SQL injection | Security feature bypass | 9.9 | Low-privileged user |
| CVE-2026-105781 | SQL injection | Security feature bypass | 9.8 | None |
| CVE-2026-104350 | Reflected XSS | Privilege escalation | 9.3 | None, but a victim must open a link |
| CVE-2026-104354 | SQL injection | Security feature bypass | 9.1 | High-privileged user |
| CVE-2026-105779 | SQL injection | Security feature bypass | 9.1 | Low-privileged user |
The CVE records describe several of these more severely than the bulletin. CVE-2026-105781 is scored 10.0 there, and its description says an attacker can run arbitrary SQL without user interaction. CVE-2026-105489 and CVE-2026-104354 are described as leading to code execution (CVE-2026-105781; CVE-2026-105489; CVE-2026-104354). The low-privileged code execution bugs need no user interaction, so any operator account, or a stolen one, is enough.
APSB26-182, Adobe Connect. CVE-2026-48360 is a code injection flaw in the Connect desktop app and Android app, CVSS 9.6. A victim has to open a malicious link or page. Affected: Windows 2026.8.51 and below, macOS Apple silicon 2026.08.45 and below, macOS Intel 2026.01.39 and below, Android 4.4 and earlier (Adobe APSB26-182).
Adobe says it is not aware of exploits in the wild for any of these issues and rates both bulletins priority 2 (Adobe APSB26-162; Adobe APSB26-182). None of the CVEs was in CISA’s KEV catalog as of 30 October (CISA KEV).
Am I affected?
Campaign Classic: any v7 instance at 7.4.4 build 9402 or earlier. The bulletin covers Windows and Linux servers. On the application server, the server build is printed by:
nlserver pdumpYou can also see the build in the client console’s About box. If Adobe hosts your Campaign instance, ask Adobe support whether it is on build 9403.
Exposure is highest where the Campaign web server is reachable from the internet, for example for tracking, landing pages or web forms, and where many operator accounts exist.
Adobe Connect: check the app version on Windows, macOS and Android devices against the fixed builds. Only the desktop and Android apps are listed as affected.
What to do now
- Upgrade every Campaign Classic v7 server to 7.4.4 build 9403, starting with instances whose web interfaces are reachable from outside.
- Until upgraded, limit access. Restrict who can reach the Campaign console and server interfaces to known networks, and remove or disable operator accounts nobody uses. Most of these bugs need only a low-privileged operator login.
- Review operator activity for logins from unfamiliar addresses and new or changed workflows and JavaScript activities since your last upgrade. Adobe has not published indicators, so this is about spotting misuse of operator accounts.
- Push Adobe Connect 2026.9.61 (Windows), 2026.10.66 (Apple silicon), 2026.10.170 (Intel Macs) and 4.5 (Android) through your software distribution tool. Adobe gives no workaround for either bulletin.