Adobe patches critical code execution risks in Campaign Classic

Eight critical Campaign Classic flaws receive fixes

Adobe has released security updates for eight critical vulnerabilities in Adobe Campaign Classic that could allow arbitrary code execution, security-feature bypass or privilege escalation. The issues affect Campaign Classic version 7.4.4 build 9402 and earlier on Windows and Linux. Adobe has addressed them in version 7.4.4 build 9403.

Four of the Campaign Classic vulnerabilities carry a CVSS score of 9.9: CVE-2026-104351, a code injection issue; CVE-2026-104353, an operating-system code injection issue; CVE-2026-105780, an incorrect authorization flaw; and CVE-2026-105489, an SQL injection flaw. The first three could lead to arbitrary code execution, while CVE-2026-105489 could enable a security-feature bypass.

The remaining four findings are CVE-2026-105781, an SQL injection vulnerability rated 9.8; CVE-2026-104350, a reflected cross-site scripting vulnerability rated 9.3; and CVE-2026-104354 and CVE-2026-105779, SQL injection vulnerabilities each rated 9.1. The SQL injection flaws are associated with security-feature bypass, while the reflected XSS issue could lead to privilege escalation.

Adobe Connect updates cover a separate critical issue

Adobe also fixed CVE-2026-48360, a critical code injection vulnerability in Adobe Connect Desktop and Mobile. Rated 9.6 on the CVSS scale, the flaw could result in arbitrary code execution on Windows, macOS and Android.

The corrected Adobe Connect Desktop releases are version 2026.9.61 for Windows, version 2026.10.66 for macOS Silicon and version 2026.10.170 for macOS Intel. Adobe Connect Mobile for Android is fixed in version 4.5.

Patch verification should include every affected platform

Adobe said it is not aware of exploits in the wild for any of the issues resolved by these updates. That status does not change the severity of the potential outcomes described in the advisories, particularly for code execution and authorization weaknesses in enterprise-facing software.

Teams operating Adobe Campaign Classic should establish whether any Windows or Linux instance remains on build 9402 or an earlier release and move it to build 9403. Organisations using Adobe Connect should similarly compare deployed desktop and mobile versions with the fixed releases.

The practical business implication is to treat these updates as a defined remediation task: inventory Campaign Classic and Connect endpoints, deploy Adobe's fixed versions, and retain confirmation that each affected platform has been updated.