Advisory · CVE-2026-104354
SQL injection in Adobe Campaign Classic lets a high-privileged attacker execute arbitrary code
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an SQL injection flaw that an attacker with high privileges can use to execute arbitrary code in the context of the current user, with scope changed and no user interaction. CVSS 3.1 9.1.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-104354
CWE-89 - Action timing
- Immediate
Explain it like I’m five
Even a highly privileged account should only be able to ask the database questions the application intends. This flaw lets such an account write its own questions and turn them into code execution.
- 01High-privileged sign-in
The attacker authenticates with a high-privileged Campaign Classic account, or compromises one.
- 02Input reaches a query
The attacker submits input incorporated into an SQL command without proper neutralization.
- 03Injected SQL runs
The database executes the attacker's SQL in the application's context.
- 04Code execution follows
Per Adobe, the injection can result in arbitrary code execution in the context of the current user, with scope changed.
What happened
Adobe published CVE-2026-104354 in NVD on October 27, 2026, rating it critical at CVSS 3.1 9.1: Adobe Campaign Classic is affected by an SQL injection vulnerability (CWE-89) that could result in arbitrary code execution in the context of the current user. Exploitation requires high privileges and no user interaction, and the scope is changed.
Adobe’s bulletin APSB26-162 covers Campaign Classic 7.4.4 build 9402 and earlier; the record lists build 9403 as the fixed, unaffected build.
What to do
- Inventory Adobe Campaign Classic instances, including application servers, execution instances, and any internet-facing web application servers, and note the build of each.
- Apply the APSB26-162 update to build 9403 or later on every instance running 7.4.4 build 9402 or earlier.
- Until every instance is updated, restrict network access to Campaign Classic consoles and application endpoints to trusted administrators and integrated systems only.
- Review Campaign Classic, web server, and database logs for unexpected code execution, new operators, changed workflows, and unusual SQL activity, especially from low-privileged accounts.
- Rotate operator passwords, database credentials, and integration secrets for any instance where suspicious activity cannot be excluded.
- Verify the deployed build after updating, including standby, staging, and disaster-recovery instances.
Management note
Campaign Classic sits on customer data and can act on it at scale, and this bulletin is a cluster of code execution and SQL injection flaws reachable with little or no privilege. Treat the bulletin as one urgent change: patch the whole estate, then work the logs, because any single one of these flaws is enough to take the platform.