Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass
Our summary
Adobe has rolled out fixes for eight critical vulnerabilities in Campaign Classic that could have let attackers execute arbitrary code, bypass security controls, or escalate privileges. The flaws include code injection issues (CVE-2026-104351, CVE-2026-104353, each CVSS 9.9), an incorrect authorization bug (CVE-2026-105780, CVSS 9.9), several SQL injection weaknesses (CVE-2026-105489, CVE-2026-105781, CVE-2026-104354, CVE-2026-105779), and a reflected XSS flaw (CVE-2026-104350, CVSS 9.3). All affect Adobe Campaign Classic version 7.4.4 build 9402 and earlier on Windows and Linux, and are resolved in build 9403.
Separately, Adobe fixed a critical code injection vulnerability in Adobe Connect Desktop and Mobile (CVE-2026-48360, CVSS 9.6) affecting Windows, macOS, and Android, which could also enable arbitrary code execution. Fixed versions include Connect Desktop for Windows 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170, and Connect Mobile for Android 4.5. Adobe states none of these issues are known to have been exploited in the wild, but recommends all users update promptly.
The Hacker News publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.