Advisory · CVE-2026-82011
SQL injection in Adobe Campaign Classic bypasses security controls
A SQL injection flaw in Adobe Campaign Classic lets a low-privileged attacker bypass security measures and gain unauthorized read and limited write access. CVSS 9.1.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-82011
CWE-89 - Action timing
- Immediate
Explain it like I’m five
A nightclub bouncer checks a guest list, but the list is read from a note anyone can edit. An attacker edits the note, and the bouncer waves them into the VIP area.
- 01Low-privileged access
An attacker holds a low-privileged account on Adobe Campaign Classic.
- 02Malicious SQL
They inject SQL where the application builds database queries.
- 03Controls bypassed
The injected query bypasses security measures the application relies on.
- 04Unauthorized access
The attacker gains read access and limited write access beyond their role, with changed scope.
What happened
Adobe security bulletin APSB26-142 includes CVE-2026-82011, a SQL injection vulnerability (CWE-89) in Adobe Campaign Classic. A low-privileged attacker can exploit it without user interaction to bypass security measures, gaining unauthorized read and limited write access. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 9.1 (v3.1).
What to do
- Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later.
- Audit Campaign roles and verify no account holds more privilege than its job needs.
- Review database logs for anomalous queries from low-privileged accounts.
Management note
Low-privilege SQL injection that defeats in-product access controls is a data-exfiltration path for ordinary insiders and compromised marketing accounts. Patch in the same cycle as the rest of APSB26-142.