Adobe Campaign Classic: SQL injection vulnerability
Summary
Adobe Campaign Classic 7.4.4 build 9402 and earlier contains an SQL injection flaw (CWE-89) that can be triggered over the network without authentication or user interaction. According to the CVE record, an attacker could execute arbitrary SQL commands and possibly gain elevated access or control over the victim's account or session, with a changed scope. Adobe's bulletin classifies the impact as security feature bypass, so the worse case should be assumed until technical details are confirmed. Adobe reports no exploitation in the wild.
Affected
- Adobe Campaign Classic ACC v7: 7.4.4 build 9402 and earlier
- Platforms: Windows, Linux
Fixed in
- Adobe Campaign Classic ACC v7: 7.4.4 build 9403 (APSB26-162)
Workaround
Unknown. No vendor workaround is documented; apply the update. Generic measures such as a web application firewall and least-privilege database accounts are reasonable interim steps but are not validated by the vendor.
Exploitation
- Adobe is not aware of any exploits in the wild.
- No public proof of concept confirmed.
- No CISA KEV listing found.
Our recommendation
- Identify all Adobe Campaign Classic 7.x instances, on-premise or hybrid, and their build numbers.
- Update to 7.4.4 build 9403 as stated in APSB26-162, and patch the whole batch of related issues in this bulletin.
- Until patched, restrict access to ACC endpoints and review logs for SQL syntax in requests.
- Recheck NVD and CISA KEV for changes, as NVD analysis is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-162 www.adobe.com
- VulDB entry 427485 vuldb.com
- The Hacker News: Adobe fixes critical Campaign Classic flaws thehackernews.com
- Strix CVE-2026-105781 www.strix.ai
- SecurityOnline: Adobe Campaign Classic vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:54.
Original description (NVD)
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.