Advisory · CVE-2026-104350
Reflected XSS in Adobe Campaign Classic can hand an attacker the victim's session
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain a reflected cross-site scripting flaw that can inject malicious scripts into a page a victim visits, potentially gaining elevated access or control over the victim's account or session, with scope changed. CVSS 3.1 9.3.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-104350
CWE-79 - Action timing
- Immediate
Explain it like I’m five
The platform echoes a visitor's input back into a page without cleaning it. An attacker crafts a link whose echo is actually a script, and whoever opens the link runs the attacker's script in their own session.
- 01Crafted link sent
The attacker builds a maliciously crafted URL carrying the script payload.
- 02Victim visits the link
A Campaign Classic user opens the URL or interacts with a compromised page, as Adobe's record requires.
- 03Script reflects into the page
The application returns a page containing the attacker's script.
- 04Victim session abused
The script runs in the victim's context, potentially gaining elevated access or control over the account or session.
What happened
Adobe published CVE-2026-104350 in NVD on October 27, 2026, rating it critical at CVSS 3.1 9.3: Adobe Campaign Classic is affected by a reflected cross-site scripting vulnerability (CWE-79). An attacker could inject malicious scripts into a web page, potentially gaining elevated access or control over the victim’s account or session. Exploitation requires user interaction, in that a victim must visit a maliciously crafted URL or interact with a compromised web page, and the scope is changed.
Adobe’s bulletin APSB26-162 covers Campaign Classic 7.4.4 build 9402 and earlier; the record lists build 9403 as the fixed, unaffected build.
What to do
- Inventory Adobe Campaign Classic instances, including application servers, execution instances, and any internet-facing web application servers, and note the build of each.
- Apply the APSB26-162 update to build 9403 or later on every instance running 7.4.4 build 9402 or earlier.
- Until every instance is updated, restrict network access to Campaign Classic consoles and application endpoints to trusted administrators and integrated systems only.
- Review Campaign Classic, web server, and database logs for unexpected code execution, new operators, changed workflows, and unusual SQL activity, especially from low-privileged accounts.
- Rotate operator passwords, database credentials, and integration secrets for any instance where suspicious activity cannot be excluded.
- Verify the deployed build after updating, including standby, staging, and disaster-recovery instances.
Management note
Campaign Classic sits on customer data and can act on it at scale, and this bulletin is a cluster of code execution and SQL injection flaws reachable with little or no privilege. Treat the bulletin as one urgent change: patch the whole estate, then work the logs, because any single one of these flaws is enough to take the platform.