Advisory · CVE-2026-105489
SQL injection in Adobe Campaign Classic lets a low-privileged attacker execute arbitrary code
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an SQL injection flaw that a low-privileged attacker can use to execute arbitrary code in the context of the current user, with scope changed and no user interaction. CVSS 3.1 9.9.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-105489
CWE-89 - Action timing
- Immediate
Explain it like I’m five
A low-level account can talk to the database in the application's own voice by hiding commands inside ordinary input. The database cannot tell the attacker's sentences from the application's.
- 01Low-privileged sign-in
The attacker authenticates with a low-privileged Campaign Classic account.
- 02Input reaches a query
The attacker submits input that is incorporated into an SQL command without proper neutralization.
- 03Injected SQL runs
The database executes the attacker's SQL in the application's context.
- 04Code execution follows
Per Adobe, the injection can result in arbitrary code execution in the context of the current user, with scope changed.
What happened
Adobe published CVE-2026-105489 in NVD on October 27, 2026, rating it critical at CVSS 3.1 9.9: Adobe Campaign Classic is affected by an SQL injection vulnerability (CWE-89) that could result in arbitrary code execution in the context of the current user. A low-privileged attacker can exploit it without user interaction, and the scope is changed.
Adobe’s bulletin APSB26-162 covers Campaign Classic 7.4.4 build 9402 and earlier; the record lists build 9403 as the fixed, unaffected build.
What to do
- Inventory Adobe Campaign Classic instances, including application servers, execution instances, and any internet-facing web application servers, and note the build of each.
- Apply the APSB26-162 update to build 9403 or later on every instance running 7.4.4 build 9402 or earlier.
- Until every instance is updated, restrict network access to Campaign Classic consoles and application endpoints to trusted administrators and integrated systems only.
- Review Campaign Classic, web server, and database logs for unexpected code execution, new operators, changed workflows, and unusual SQL activity, especially from low-privileged accounts.
- Rotate operator passwords, database credentials, and integration secrets for any instance where suspicious activity cannot be excluded.
- Verify the deployed build after updating, including standby, staging, and disaster-recovery instances.
Management note
Campaign Classic sits on customer data and can act on it at scale, and this bulletin is a cluster of code execution and SQL injection flaws reachable with little or no privilege. Treat the bulletin as one urgent change: patch the whole estate, then work the logs, because any single one of these flaws is enough to take the platform.