Advisory · CVE-2026-105780
Incorrect authorization in Adobe Campaign Classic lets a low-privileged attacker execute arbitrary code
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an incorrect authorization flaw that a low-privileged attacker can use to execute arbitrary code in the context of the current user, with scope changed and no user interaction. CVSS 3.1 9.9.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-105780
CWE-863 - Action timing
- Immediate
Explain it like I’m five
The platform checks the wrong permission, or checks it in the wrong place, before letting an account reach a powerful function. A low-level account walks through a door that was meant for administrators.
- 01Low-privileged sign-in
The attacker authenticates with a low-privileged Campaign Classic account.
- 02Protected function requested
The attacker requests a function whose authorization the application evaluates incorrectly.
- 03Check passes wrongly
The incorrect authorization decision grants access the account should not have.
- 04Code executes
Per Adobe, the flaw can result in arbitrary code execution in the context of the current user, with scope changed.
What happened
Adobe published CVE-2026-105780 in NVD on October 27, 2026, rating it critical at CVSS 3.1 9.9: Adobe Campaign Classic is affected by an incorrect authorization vulnerability (CWE-863) that could result in arbitrary code execution in the context of the current user. A low-privileged attacker can exploit it without user interaction, and the scope is changed.
Adobe’s bulletin APSB26-162 covers Campaign Classic 7.4.4 build 9402 and earlier; the record lists build 9403 as the fixed, unaffected build.
What to do
- Inventory Adobe Campaign Classic instances, including application servers, execution instances, and any internet-facing web application servers, and note the build of each.
- Apply the APSB26-162 update to build 9403 or later on every instance running 7.4.4 build 9402 or earlier.
- Until every instance is updated, restrict network access to Campaign Classic consoles and application endpoints to trusted administrators and integrated systems only.
- Review Campaign Classic, web server, and database logs for unexpected code execution, new operators, changed workflows, and unusual SQL activity, especially from low-privileged accounts.
- Rotate operator passwords, database credentials, and integration secrets for any instance where suspicious activity cannot be excluded.
- Verify the deployed build after updating, including standby, staging, and disaster-recovery instances.
Management note
Campaign Classic sits on customer data and can act on it at scale, and this bulletin is a cluster of code execution and SQL injection flaws reachable with little or no privilege. Treat the bulletin as one urgent change: patch the whole estate, then work the logs, because any single one of these flaws is enough to take the platform.