High priorityDisclosed

Advisory · CVE-2026-82011

SQL injection in Adobe Campaign Classic bypasses security controls

A SQL injection flaw in Adobe Campaign Classic lets a low-privileged attacker bypass security measures and gain unauthorized read and limited write access. CVSS 9.1.

Vendor
Adobe
Product
Adobe Campaign Classic
Identifier / CWE
CVE-2026-82011
CWE-89
Action timing
Immediate
ELI5

Explain it like I’m five

A nightclub bouncer checks a guest list, but the list is read from a note anyone can edit. An attacker edits the note, and the bouncer waves them into the VIP area.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Low-privileged access

    An attacker holds a low-privileged account on Adobe Campaign Classic.

  2. 02Malicious SQL

    They inject SQL where the application builds database queries.

  3. 03Controls bypassed

    The injected query bypasses security measures the application relies on.

  4. 04Unauthorized access

    The attacker gains read access and limited write access beyond their role, with changed scope.

What happened

Adobe security bulletin APSB26-142 includes CVE-2026-82011, a SQL injection vulnerability (CWE-89) in Adobe Campaign Classic. A low-privileged attacker can exploit it without user interaction to bypass security measures, gaining unauthorized read and limited write access. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 9.1 (v3.1).

What to do

  1. Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later.
  2. Audit Campaign roles and verify no account holds more privilege than its job needs.
  3. Review database logs for anomalous queries from low-privileged accounts.

Management note

Low-privilege SQL injection that defeats in-product access controls is a data-exfiltration path for ordinary insiders and compromised marketing accounts. Patch in the same cycle as the rest of APSB26-142.