Adobe patches eight critical Campaign Classic flaws and a Connect bug
Original title: Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass
Campaign Classic through 7.4.4 build 9402 is fixed in build 9403; Adobe reports no known exploits.
Adobe patched eight critical flaws in Campaign Classic that can lead to arbitrary code execution, security-feature bypass, or privilege escalation via code injection, incorrect authorization, SQL injection, and reflected cross-site scripting. Affected releases are 7.4.4 build 9402 and earlier on Windows and Linux; the fix is 7.4.4 build 9403. A separate critical code-injection bug in Connect Desktop and Mobile, CVE-2026-48360, is fixed in named desktop and Android builds. Adobe said it is not aware of exploits in the wild.
- Four Campaign Classic issues score 9.9: CVE-2026-104351, CVE-2026-104353, CVE-2026-105780 and CVE-2026-105489.
- Other Campaign scores are 9.8, 9.3 and two at 9.1.
- Connect Desktop fixes are Windows 2026.9.61, macOS Silicon 2026.10.66 and macOS Intel 2026.10.170.
- Adobe Connect Mobile for Android is fixed in version 4.5; CVE-2026-48360 scores 9.6.
Impact: Arbitrary code execution, security bypass, or privilege escalation
| Product | Affected | Fixed in |
|---|---|---|
| Adobe Campaign Classic | 7.4.4 build 9402 and earlier for Windows and Linux | 7.4.4 build 9403 |
| Adobe Connect Desktop | — | Windows 2026.9.61; macOS Silicon 2026.10.66; macOS Intel 2026.10.170 |
| Adobe Connect Mobile for Android | — | 4.5 |
- 1.Update Campaign Classic to 7.4.4 build 9403.
- 2.Update Connect Desktop and Android Connect Mobile to the fixed versions Adobe listed.
- CVEs
- CVE-2026-104351CVE-2026-104353CVE-2026-105780CVE-2026-105489CVE-2026-105781CVE-2026-104350CVE-2026-104354CVE-2026-105779CVE-2026-48360
- Vendors
- Adobe
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-104351+1 related CVE | Code injection in Adobe Campaign Classic | 9.9 group max | — | ||
| CVE-2026-105781 | SQL Injection in Adobe Campaign Classic | 10.0 group max | — | ||
| CVE-2026-48360 | Code injection in Adobe Connect via crafted page | 9.6 | — |
From the original article
1 min read at thehackernews.com
Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation. The list of eight vulnerabilities is as follows - CVE-2026-104351 (CVSS score: 9. 9) - A code injection vulnerability that could lead to arbitrary code execution.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.