Advisory · CVE-2026-105779
SQL injection in Adobe Campaign Classic bypasses security controls for read and limited write access
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an SQL injection flaw that a low-privileged attacker can use to bypass security measures and gain unauthorized read and limited write access, with scope changed and no user interaction. CVSS 3.1 9.1.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-105779
CWE-89 - Action timing
- Immediate
Explain it like I’m five
A low-level account can phrase its input so the database answers questions it was never meant to ask, reading data it should not see and writing a little of its own.
- 01Low-privileged sign-in
The attacker authenticates with a low-privileged Campaign Classic account.
- 02Input reaches a query
The attacker submits input incorporated into an SQL command without proper neutralization.
- 03Security measures bypassed
The injected SQL bypasses the application's security measures.
- 04Data read and written
Per Adobe, the attacker gains unauthorized read and limited write access, with scope changed.
What happened
Adobe published CVE-2026-105779 in NVD on October 27, 2026, rating it critical at CVSS 3.1 9.1: Adobe Campaign Classic is affected by an SQL injection vulnerability (CWE-89) that could result in a security feature bypass. A low-privileged attacker could leverage it to bypass security measures and gain unauthorized read and limited write access, without user interaction, and the scope is changed.
Adobe’s bulletin APSB26-162 covers Campaign Classic 7.4.4 build 9402 and earlier; the record lists build 9403 as the fixed, unaffected build.
What to do
- Inventory Adobe Campaign Classic instances, including application servers, execution instances, and any internet-facing web application servers, and note the build of each.
- Apply the APSB26-162 update to build 9403 or later on every instance running 7.4.4 build 9402 or earlier.
- Until every instance is updated, restrict network access to Campaign Classic consoles and application endpoints to trusted administrators and integrated systems only.
- Review Campaign Classic, web server, and database logs for unexpected code execution, new operators, changed workflows, and unusual SQL activity, especially from low-privileged accounts.
- Rotate operator passwords, database credentials, and integration secrets for any instance where suspicious activity cannot be excluded.
- Verify the deployed build after updating, including standby, staging, and disaster-recovery instances.
Management note
Campaign Classic sits on customer data and can act on it at scale, and this bulletin is a cluster of code execution and SQL injection flaws reachable with little or no privilege. Treat the bulletin as one urgent change: patch the whole estate, then work the logs, because any single one of these flaws is enough to take the platform.