Adobe Patches Eight Critical Campaign Classic Flaws

Adobe has released patches for eight critical security flaws in Campaign Classic. If exploited, the vulnerabilities could lead to arbitrary code execution, security feature bypass, and privilege escalation. Adobe said it is not aware of any exploits in the wild for the issues addressed in the update.

Affected Versions and Fixes

The issues affect Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux. They have been patched in version 7.4.4 build 9403. Users are advised to update to the latest version for optimal protection.

Campaign Classic Vulnerabilities

The list includes CVE-2026-104351 and CVE-2026-104353, both with CVSS scores of 9.9, as code injection and operating system code injection flaws that could lead to arbitrary code execution. CVE-2026-105780, also scored 9.9, is an incorrect authorization vulnerability that could lead to arbitrary code execution. CVE-2026-105489, CVE-2026-105781, CVE-2026-104354, and CVE-2026-105779 are SQL injection vulnerabilities that could lead to security feature bypass, with CVSS scores of 9.9, 9.8, 9.1, and 9.1 respectively. CVE-2026-104350 is a reflected cross-site scripting vulnerability with a CVSS score of 9.3 that could lead to privilege escalation.

Adobe Connect Fix

Adobe also resolved a critical code injection flaw in Adobe Connect Desktop and Mobile for Windows, macOS, and Android, tracked as CVE-2026-48360 with a CVSS score of 9.6, that could result in arbitrary code execution. The vulnerability has been fixed in Adobe Connect Desktop for Windows version 2026.9.61, macOS Silicon version 2026.10.66, macOS Intel version 2026.10.170, and Adobe Connect Mobile for Android version 4.5.

Sources: The Hacker News