Adobe patches eight critical Campaign Classic flaws, four at 9.9
Adobe bulletin APSB26-162 fixes eight critical Campaign Classic flaws, four scored CVSS 9.9, including code and OS-command injection enabling RCE. Fixed in 7.4.4 build 9403.
Adobe shipped bulletin APSB26-162 fixing eight critical vulnerabilities in Campaign Classic (ACC) v7, four of them scored CVSS 9.9. The worst enable arbitrary code execution on the Campaign server. All affect ACC v7 7.4.4 build 9402 and earlier on Windows and Linux; the fix is 7.4.4 build 9403. Adobe says it is not aware of any exploits in the wild for the set.
The flaws
Per Adobe's bulletin:
| CVE | Type | Impact | CVSS |
|---|---|---|---|
| CVE-2026-104351 | Code injection | Arbitrary code execution | 9.9 |
| CVE-2026-104353 | OS command injection | Arbitrary code execution | 9.9 |
| CVE-2026-105780 | Incorrect authorization | Arbitrary code execution | 9.9 |
| CVE-2026-105489 | SQL injection | Security feature bypass | 9.9 |
| CVE-2026-105781 | SQL injection | Security feature bypass | 9.8 |
| CVE-2026-104350 | Reflected XSS | Privilege escalation | 9.3 |
| CVE-2026-104354 | SQL injection | Security feature bypass | 9.1 |
| CVE-2026-105779 | SQL injection | Security feature bypass | 9.1 |
Three distinct paths reach code execution — a code-injection bug, an OS-command-injection bug, and an authorization flaw that Adobe rates as allowing ACE on its own. The remaining five are SQL injection and a reflected XSS that chains to privilege escalation. The injection-heavy spread points at input handling across Campaign's admin surface rather than one isolated endpoint.
Action checklist
- Update on-premise ACC v7 to 7.4.4 build 9403 on Windows and Linux. Adobe assigns this a priority typical of code-execution bulletins; treat it as this week's work.
- Do not expose the Campaign admin interface to the internet. Campaign servers handle customer data and run close to marketing automation workflows — keep management behind the VPN or admin network.
- After patching, review application and database logs for injection-shaped input and unexpected OS process spawns from the Campaign service account.
- Rotate the Campaign database and service-account credentials if the instance ran a vulnerable build while reachable from untrusted networks.
Context
Adobe Campaign Classic has taken a steady run of critical code-execution fixes through 2026, including a prior OS-command-injection flaw rated the full CVSS 10.0. On-premise marketing stacks rarely get the patch urgency a public-facing web app does, yet they sit on rich customer datasets and run server-side scripting by design. Four 9.9s in one bulletin is the reminder: an internal-feeling marketing server is still an application server, and it is still a target.