Advisory · CVE-2026-82009
SQL injection in Adobe Campaign Classic enables code execution for privileged attackers
A SQL injection flaw in Adobe Campaign Classic lets an attacker with high privileges execute arbitrary SQL commands and reach code execution. CVSS 9.1.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-82009
CWE-89 - Action timing
- Immediate
Explain it like I’m five
A librarian takes search requests and reads them word for word to the archive robot. An attacker phrases the request as a command, and the robot obeys it as an order instead of a search.
- 01Privileged access
An attacker holds a high-privileged account on Adobe Campaign Classic.
- 02Malicious SQL
They submit input containing SQL commands where the application expects data.
- 03Query executed
The database runs the injected commands with the application's privileges.
- 04Code execution
The attacker escalates from SQL execution to arbitrary code execution in the user context.
What happened
Adobe security bulletin APSB26-142 includes CVE-2026-82009, a SQL injection vulnerability (CWE-89) in Adobe Campaign Classic. An attacker with high privileges can execute arbitrary SQL commands without user interaction, potentially leading to arbitrary code execution in the context of the current user with changed scope. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 9.1 (v3.1).
What to do
- Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later.
- Review database query logs for unexpected statements from application accounts.
- Rotate database and service credentials if exploitation cannot be ruled out.
Management note
High-privilege SQL injection matters because Campaign databases hold customer and campaign data. The attacker needs an account first, which makes this a strong argument for least-privilege roles inside the product.