Adobe has shipped fixes for eight critical vulnerabilities in Campaign Classic, the marketing automation platform used to run large-scale email and campaign operations.
Four of them carry a CVSS score of 9.9. CVE-2026-104351 is a code injection bug that allows arbitrary code execution. CVE-2026-104353 is the same class of code injection at the operating system level. CVE-2026-105780 is an incorrect authorization flaw that also ends in execution. CVE-2026-105489 is a SQL injection that bypasses security features.
Below that, CVE-2026-105781 scores 9.8 as another SQL injection. A reflected cross-site scripting bug, CVE-2026-104350, rates 9.3 and can escalate privileges. Two further SQL injections, CVE-2026-104354 and CVE-2026-105779, both score 9.1.
Who needs to move
Every one of those issues affects Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux. The fix lands in build 9403.
Adobe also resolved a critical code injection flaw in Connect Desktop and Mobile, tracked as CVE-2026-48360 at 9.6. Fixed builds are 2026.9.61 for Connect Desktop on Windows, 2026.10.66 for macOS Silicon, 2026.10.170 for macOS Intel, and 2026.4.5 or later for Connect Mobile on Android.
No exploits seen, no room to wait
The vendor says it is not aware of any exploits in the wild for the issues addressed in this update. That is a statement about the present, not a guarantee about the next few weeks.
Campaign Classic sits inside marketing pipelines that touch customer databases and often hold service credentials for adjacent systems, so an unreachable staging instance running build 9402 is as much of a liability as production. Inventory every installation, including ones managed by agencies or integrators, and confirm the build number rather than the patch notification.
