High priorityDisclosed

Advisory · CVE-2026-82009

SQL injection in Adobe Campaign Classic enables code execution for privileged attackers

A SQL injection flaw in Adobe Campaign Classic lets an attacker with high privileges execute arbitrary SQL commands and reach code execution. CVSS 9.1.

Vendor
Adobe
Product
Adobe Campaign Classic
Identifier / CWE
CVE-2026-82009
CWE-89
Action timing
Immediate
ELI5

Explain it like I’m five

A librarian takes search requests and reads them word for word to the archive robot. An attacker phrases the request as a command, and the robot obeys it as an order instead of a search.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Privileged access

    An attacker holds a high-privileged account on Adobe Campaign Classic.

  2. 02Malicious SQL

    They submit input containing SQL commands where the application expects data.

  3. 03Query executed

    The database runs the injected commands with the application's privileges.

  4. 04Code execution

    The attacker escalates from SQL execution to arbitrary code execution in the user context.

What happened

Adobe security bulletin APSB26-142 includes CVE-2026-82009, a SQL injection vulnerability (CWE-89) in Adobe Campaign Classic. An attacker with high privileges can execute arbitrary SQL commands without user interaction, potentially leading to arbitrary code execution in the context of the current user with changed scope. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 9.1 (v3.1).

What to do

  1. Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later.
  2. Review database query logs for unexpected statements from application accounts.
  3. Rotate database and service credentials if exploitation cannot be ruled out.

Management note

High-privilege SQL injection matters because Campaign databases hold customer and campaign data. The attacker needs an account first, which makes this a strong argument for least-privilege roles inside the product.