Adobe Security Bulletin

Last updated on Oct 27, 2026

Security update available for Adobe Campaign Classic | APSB26-162

Bulletin ID

Date published

Priority

APSB26-162

October 27, 2026

2

style

grid width 12

Summary

Adobe has released a priority 2 security update for Adobe Campaign Classic. This update addresses vulnerabilities rated critical that could result in arbitrary code execution, security feature bypass, and privilege escalation.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected Versions

Product

Version

Platform

Adobe Campaign Classic

ACC v7: 7.4.4 build 9402 and earlier

Windows, Linux

style

grid width 12

Solution

Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version:

Product

Updated version

Platform

Priority rating

Installation instructions

Adobe Campaign Classic

ACC v7: 7.4.4 build 9403

Windows, Linux

2

Release Notes

style

grid width 12

Vulnerability Details

CVE-2026-104351

Vulnerability category: Improper Control of Generation of Code ('Code Injection') (CWE-94)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-104353

Vulnerability category: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-105780

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-105489

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVE-2026-105781

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVE-2026-104350

Vulnerability category: Cross-site Scripting (Reflected XSS) (CWE-79)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 9.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

CVE-2026-104354

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVE-2026-105779

Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

NOTE: Adobe maintains a public bug bounty program through Intigriti. If you’re an external security researcher interested in identifying and responsibly reporting potential security vulnerabilities to Adobe, please visit the Adobe Bug Bounty Program for more information.

For more information, visit Adobe Security Bulletin and Advisories or email PSIRT@adobe.com.

CardTitle

APSB26-162

CardDescription

Priority 2 Security update

CardImage