Adobe has released security updates addressing nine critical vulnerabilities affecting Adobe Campaign Classic and Adobe Connect. The flaws could allow attackers to execute arbitrary code, bypass security protections, access or modify database information, or escalate privileges on vulnerable systems. Several of the vulnerabilities can be exploited using only low-level privileges, while some do not require authentication at all, making the updates particularly important for organisations using affected versions.
Adobe Campaign Classic accounts for eight of the critical vulnerabilities, while Adobe Connect is affected by one critical code-injection flaw. The vulnerabilities carry CVSS 3.1 scores ranging from 9.1 to 9.9, placing all of them in the critical severity category. At the time the updates were released, there were no known reports of active exploitation in the wild.
Eight Critical Vulnerabilities Affect Adobe Campaign Classic
Adobe Campaign Classic is affected by eight critical vulnerabilities involving code injection, operating-system command injection, incorrect authorisation, SQL injection and reflected cross-site scripting. These flaws can potentially affect the confidentiality, integrity and overall security of the server and its underlying database.
Three of the vulnerabilities can allow attackers with low-level privileges to execute arbitrary code directly on the affected server. Four others involve SQL injection, potentially giving attackers access to sensitive database information or allowing data modification. The remaining flaw involves reflected cross-site scripting that could lead to privilege escalation.
CVE-2026-104351 Allows Arbitrary Code Execution
CVE-2026-104351 is a critical code-injection vulnerability in Adobe Campaign Classic with a CVSS score of 9.9. An attacker with low-level privileges can exploit the flaw to execute arbitrary code on the affected server.
This significantly increases the impact of a compromised low-privilege account. An attacker does not necessarily need administrative access before attempting to take control of the application environment. Organisations should therefore treat even lower-level Campaign Classic credentials as potentially significant while vulnerable versions remain installed.
CVE-2026-104353 Is An OS Command Injection Vulnerability
CVE-2026-104353 is another critical vulnerability rated 9.9. It involves operating-system command injection and can be exploited by an attacker with low-level privileges.
Successful exploitation could allow commands to be executed on the underlying server rather than remaining confined to normal application functionality. That makes the vulnerability particularly dangerous because compromise of the application could potentially extend into the operating-system environment itself.
CVE-2026-105780 Involves Incorrect Authorisation
CVE-2026-105780 also carries a CVSS score of 9.9 and involves incorrect authorisation within Adobe Campaign Classic. An attacker with low-level privileges could exploit the weakness to execute arbitrary code on the affected server.
Authorisation vulnerabilities occur when software incorrectly allows a user to perform actions beyond the permissions they should normally possess. In this case, that failure could lead to full code execution, making the flaw far more serious than a simple access-control mistake.
Four SQL Injection Vulnerabilities Were Fixed
Adobe Campaign Classic is also affected by four critical SQL injection vulnerabilities. These flaws can allow attackers to bypass security protections and interact directly with the application's back-end database in ways that should not normally be permitted.
Depending on the vulnerability, attackers may be able to access sensitive information, modify stored data or otherwise interfere with the database. The affected vulnerabilities are CVE-2026-105489, CVE-2026-105781, CVE-2026-104354 and CVE-2026-105779.
CVE-2026-105489 Carries A CVSS Score Of 9.9
CVE-2026-105489 is a critical SQL injection vulnerability rated 9.9. An attacker with low-level privileges could exploit the flaw to bypass security features and access or modify information stored in the database.
The ability to modify database content increases the potential impact because the attacker would not be limited to simply reading information. Data integrity could also be affected if records are changed or manipulated.
CVE-2026-105781 Can Be Exploited Without Authentication
One of the most concerning vulnerabilities is CVE-2026-105781, which has a CVSS score of 9.8. Unlike several of the other Campaign Classic flaws, this SQL injection vulnerability can be exploited by an unauthenticated attacker.
Successful exploitation could allow the attacker to bypass security protections and access or modify database data without first obtaining a valid Campaign Classic account. This significantly lowers the barrier to exploitation and makes affected systems a high priority for remediation.
CVE-2026-104354 Requires High-Level Privileges
CVE-2026-104354 is another SQL injection vulnerability, carrying a CVSS score of 9.1. Exploitation requires an attacker with high-level privileges.
If successfully exploited, the flaw could allow security controls to be bypassed and database information to be accessed or modified. Although the attacker requires greater privileges than with several of the other vulnerabilities, the potential impact remains critical.
CVE-2026-105779 Can Expose Database Information
CVE-2026-105779 also carries a CVSS score of 9.1 and can be exploited by attackers with low-level privileges. The flaw could allow security protections to be bypassed and database information to be accessed.
Even where data modification is not listed as the primary impact, unauthorised access to information can still create serious confidentiality concerns. Organisations should therefore review lower-level user accounts as part of the remediation process.
Reflected XSS Could Lead To Privilege Escalation
Adobe Campaign Classic is also affected by CVE-2026-104350, a reflected cross-site scripting vulnerability rated 9.3. The flaw can be exploited by an unauthenticated attacker if a user interacts with a specially crafted link.
Successful exploitation could allow the attacker to escalate privileges. Because user interaction is involved, organisations should advise users to remain cautious with unexpected links until the affected systems have been updated.
Adobe Connect Is Also Affected By A Critical Vulnerability
Adobe Connect is affected by a separate critical code-injection vulnerability tracked as CVE-2026-48360. The flaw carries a CVSS score of 9.6 and can be exploited by an unauthenticated attacker.
Successful exploitation requires the target user to interact with specially crafted content. If that interaction occurs, the attacker could execute arbitrary code on the user's system.
User Interaction Is Required For The Adobe Connect Attack
Although CVE-2026-48360 does not require authentication, the user still needs to interact with maliciously prepared content before exploitation can occur. This makes social engineering an important part of the attack path.
Users should therefore avoid opening unexpected meeting content or interacting with material received from untrusted sources until the affected Adobe Connect versions have been updated. This precaution should only be treated as temporary protection, as installing the corrected software remains the proper solution.
Adobe Campaign Classic 7.4.4 Build 9402 And Earlier Are Affected
Adobe Campaign Classic v7 installations running 7.4.4 build 9402 and earlier on Windows or Linux are affected by the disclosed vulnerabilities.
The fixed version is:
Administrators should verify the exact build number after updating. Simply running version 7.4.4 is not sufficient if the installation remains on build 9402 or an earlier build.
Adobe Connect Desktop For Windows Requires Version 2026.9.61
Adobe Connect Desktop for Windows is affected when running 2026.8.51 and earlier.
The fixed version is:
Organisations using endpoint-management tools should verify that the corrected version has reached every managed Windows device rather than assuming all users have updated successfully.
Apple Silicon Macs Require Adobe Connect 2026.10.66
For Adobe Connect Desktop on Apple Silicon Macs, affected versions include 2026.08.45 and earlier.
The fixed version is:
Apple Silicon systems should be checked separately from Intel-based Macs because the corrected versions differ between the two hardware platforms.
Intel Macs Require Adobe Connect 2026.10.170
Adobe Connect Desktop on Intel-based macOS systems is affected when running 2026.01.39 and earlier.
The fixed version is:
Older Intel Macs can easily be overlooked during software remediation, particularly when newer Apple Silicon systems dominate an organisation's endpoint inventory. Both platforms need to be included in the update process.
Android Users Need Adobe Connect Mobile 4.5
Adobe Connect Mobile for Android is affected when running version 4.4 and earlier.
The fixed version is:
Mobile devices should be included in the remediation effort alongside desktop systems. Organisations using managed Android devices should verify the installed application version through their endpoint-management platform where possible.
Adobe Assigns Priority Rating 2 To Both Updates
Adobe has assigned a Priority 2 rating to the Campaign Classic and Adobe Connect security updates. At the time of disclosure, there were no known exploits in the wild targeting the vulnerabilities.
The lack of confirmed exploitation provides organisations with an opportunity to patch before attackers begin weaponising the flaws. However, several of the vulnerabilities offer extremely serious outcomes, including unauthenticated database access and arbitrary code execution, so delaying remediation would unnecessarily increase exposure.
Campaign Classic Accounts Should Be Reviewed
Organisations should also review existing Adobe Campaign Classic user accounts and remove access that is no longer required. Several of the critical vulnerabilities can be exploited using low-level privileges, meaning compromised ordinary user accounts could potentially become much more dangerous than expected.
Unused, dormant or unnecessary accounts should therefore be removed. Limiting account access does not replace patching, but it reduces the number of credentials that could potentially be abused.
Low-Level Privileges Should Not Be Underestimated
A low-privilege account normally provides limited capabilities, but vulnerabilities can allow those boundaries to be bypassed. Several of the Campaign Classic flaws demonstrate how an attacker with relatively little legitimate access could potentially escalate towards full server compromise.
This is why least-privilege access and patch management need to work together. Restricting user permissions helps reduce exposure, but known vulnerabilities that bypass those restrictions still need to be removed through software updates.
SQL Injection Creates Serious Data Risks
The SQL injection vulnerabilities are especially concerning because Campaign Classic may contain large amounts of customer and contact information. Successful exploitation could expose database records or allow attackers to modify them.
That means the impact is not limited to application availability. Confidentiality and data integrity may also be affected. Organisations relying on Campaign Classic should therefore consider potential database compromise when assessing the severity of the vulnerabilities.
Arbitrary Code Execution Creates A Wider Threat
The code-execution vulnerabilities could potentially give attackers influence beyond the Campaign Classic application itself. Once arbitrary code is running on the server, the attacker may be able to interact with operating-system resources available to the compromised service.
The exact impact would depend on how the server and application permissions are configured, but arbitrary code execution should always be treated as a serious escalation. Network segmentation, restricted service accounts and monitoring can help reduce the potential blast radius, but patching remains essential.
Adobe Connect Users Should Avoid Suspicious Content
Until every affected Adobe Connect installation has been updated, users should be cautious when receiving unexpected links, meeting content or files from unfamiliar sources. CVE-2026-48360 specifically requires interaction with specially crafted content.
User awareness can lower short-term exposure, but attackers can make malicious content appear convincing. The safest approach is to update the Adobe Connect application as soon as the fixed version becomes available for the relevant platform.
Endpoint Management Can Help Verify Compliance
Organisations managing large numbers of devices should use endpoint-management tools to verify that Adobe Connect updates have actually been installed. Windows, Apple Silicon macOS, Intel macOS and Android all require different corrected versions.
A central software inventory can quickly identify machines that remain vulnerable. This is particularly important for devices that are rarely connected to the corporate network or belong to remote employees.
Installing The Patch Is Only The First Step
Security remediation should include verification after deployment. Administrators should confirm the exact version installed and ensure affected applications have restarted or been updated correctly.
For Adobe Campaign Classic, the target is 7.4.4 build 9403. Adobe Connect users need the corrected version that matches their operating system.
A patch that was scheduled but failed to install leaves the same vulnerability in place.
There Are No Confirmed Exploits In The Wild Yet
At the time these updates were released, Adobe was not aware of active exploitation of any of the nine vulnerabilities. That is positive news, but it should not be interpreted as a reason to delay.
Once security updates become available, attackers can analyse the differences between vulnerable and corrected versions to identify the underlying flaws. High-severity vulnerabilities are particularly attractive targets for this kind of reverse engineering.
Patching early is therefore considerably safer than waiting for the first reports of exploitation.
Final Thoughts
Adobe's latest security release addresses nine critical vulnerabilities affecting Adobe Campaign Classic and Adobe Connect. Eight flaws affect Campaign Classic, while one critical code-injection vulnerability affects Adobe Connect across several desktop and mobile platforms.
Campaign Classic contains three vulnerabilities capable of allowing low-privileged attackers to execute arbitrary code, four critical SQL injection flaws and a reflected cross-site scripting vulnerability that could lead to privilege escalation. Particularly concerning is CVE-2026-105781, which can be exploited without authentication to bypass security controls and potentially access or modify database information.
Adobe Connect is affected by CVE-2026-48360, which could allow an unauthenticated attacker to execute arbitrary code if a user interacts with specially crafted content.
Organisations should upgrade Adobe Campaign Classic to 7.4.4 build 9403 and deploy the appropriate fixed Adobe Connect version across Windows, Apple Silicon macOS, Intel macOS and Android devices. Campaign Classic user accounts should also be reviewed, unnecessary access removed and users reminded to avoid suspicious links or untrusted meeting content until updates are complete.
There are currently no known attacks exploiting these vulnerabilities in the wild, but with several flaws carrying CVSS scores as high as 9.9, the safest approach is to patch before attackers begin turning the published fixes into working exploits.
Comments 0