Act nowDisclosed

Advisory · CVE-2026-104351

Code injection in Adobe Campaign Classic lets a low-privileged attacker execute arbitrary code

Adobe Campaign Classic 7.4.4 build 9402 and earlier contain a code injection flaw that a low-privileged attacker can use to execute arbitrary code in the context of the current user, with scope changed and no user interaction. CVSS 3.1 9.9.

Advisory published October 27, 2026Independent summary
Vendor
Adobe
Product
Adobe Campaign Classic
Identifier / CWE
CVE-2026-104351
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

A low-level account can feed the platform code instead of data, and the platform runs it. The smallest key on the ring opens the server room.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Low-privileged sign-in

    The attacker authenticates with a low-privileged Campaign Classic account.

  2. 02Crafted input submitted

    The attacker submits input that the application treats as code rather than data.

  3. 03Code executes

    The application generates and runs the injected code in the context of the current user.

  4. 04Scope expands

    Because scope is changed, the impact extends beyond the vulnerable component's own authority.

What happened

Adobe published CVE-2026-104351 in NVD on October 27, 2026, rating it critical at CVSS 3.1 9.9: Adobe Campaign Classic is affected by an improper control of generation of code vulnerability (CWE-94) that could result in arbitrary code execution in the context of the current user. A low-privileged attacker can exploit it without user interaction, and the scope is changed.

Adobe’s bulletin APSB26-162 covers Campaign Classic 7.4.4 build 9402 and earlier; the record lists build 9403 as the fixed, unaffected build.

What to do

  1. Inventory Adobe Campaign Classic instances, including application servers, execution instances, and any internet-facing web application servers, and note the build of each.
  2. Apply the APSB26-162 update to build 9403 or later on every instance running 7.4.4 build 9402 or earlier.
  3. Until every instance is updated, restrict network access to Campaign Classic consoles and application endpoints to trusted administrators and integrated systems only.
  4. Review Campaign Classic, web server, and database logs for unexpected code execution, new operators, changed workflows, and unusual SQL activity, especially from low-privileged accounts.
  5. Rotate operator passwords, database credentials, and integration secrets for any instance where suspicious activity cannot be excluded.
  6. Verify the deployed build after updating, including standby, staging, and disaster-recovery instances.

Management note

Campaign Classic sits on customer data and can act on it at scale, and this bulletin is a cluster of code execution and SQL injection flaws reachable with little or no privilege. Treat the bulletin as one urgent change: patch the whole estate, then work the logs, because any single one of these flaws is enough to take the platform.