Advisory · CVE-2026-105781
Unauthenticated SQL injection in Adobe Campaign Classic can execute arbitrary code
Adobe Campaign Classic 7.4.4 build 9402 and earlier contain an SQL injection flaw that an unauthenticated attacker can use to execute arbitrary SQL commands and, per Adobe, arbitrary code in the context of the current user, with scope changed. CVSS 3.1 10.0.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-105781
CWE-89 - Action timing
- Immediate
Explain it like I’m five
The marketing platform takes input and folds it straight into database commands without cleaning it first. A stranger with no account at all can slip their own commands into that stream and end up running code on the server.
- 01Attacker reaches the application
An unauthenticated attacker sends a crafted request to a Campaign Classic instance running build 9402 or earlier.
- 02Input reaches a query
The application incorporates the attacker-supplied input into an SQL command without proper neutralization.
- 03Injected SQL runs
The database executes the attacker's commands in the application's context.
- 04Code execution follows
Per Adobe, the injection can result in arbitrary code execution in the context of the current user, with scope changed.
What happened
Adobe published CVE-2026-105781 in NVD on October 27, 2026, rating it critical at CVSS 3.1 10.0: Adobe Campaign Classic is affected by an SQL injection vulnerability (CWE-89) that could result in arbitrary code execution in the context of the current user. An attacker needs no privileges and no user interaction; exploitation lets them execute arbitrary SQL commands, potentially gaining elevated access or control over the victim’s account or session, and the scope is changed.
Adobe’s bulletin APSB26-162 covers Campaign Classic 7.4.4 build 9402 and earlier; the record lists build 9403 as the fixed, unaffected build.
What to do
- Inventory Adobe Campaign Classic instances, including application servers, execution instances, and any internet-facing web application servers, and note the build of each.
- Apply the APSB26-162 update to build 9403 or later on every instance running 7.4.4 build 9402 or earlier.
- Until every instance is updated, restrict network access to Campaign Classic consoles and application endpoints to trusted administrators and integrated systems only.
- Review Campaign Classic, web server, and database logs for unexpected code execution, new operators, changed workflows, and unusual SQL activity, especially from low-privileged accounts.
- Rotate operator passwords, database credentials, and integration secrets for any instance where suspicious activity cannot be excluded.
- Verify the deployed build after updating, including standby, staging, and disaster-recovery instances.
Management note
Campaign Classic sits on customer data and can act on it at scale, and this bulletin is a cluster of code execution and SQL injection flaws reachable with little or no privilege. Treat the bulletin as one urgent change: patch the whole estate, then work the logs, because any single one of these flaws is enough to take the platform.