Affected Systems
Adobe Campaign Classic versions 7.4.4 build 9402 and earlier on Windows and Linux. Eight critical vulnerabilities (CVE-2026-104351, CVE-2026-104353, CVE-2026-105780, CVE-2026-105489, CVE-2026-105781, CVE-2026-104350, CVE-2026-104354, CVE-2026-105779) with CVSS scores ranging from 9.1 to 9.9. Patched in version 7.4.4 build 9403.
Exploitation Status
No active exploitation reported. Adobe states they are not aware of any exploits in the wild for any of the patched issues. No public PoC available at this time.
Business Impact
Organizations running Adobe Campaign Classic face risk of arbitrary code execution, security feature bypass, and privilege escalation. The vulnerabilities include code injection, OS command injection, incorrect authorization, SQL injection, and reflected XSS. Given the critical CVSS scores (9.1-9.9) and potential for full system compromise, these flaws represent significant risk to marketing automation infrastructure and customer data. No evidence of active exploitation reduces immediate urgency but does not eliminate risk.
Urgency
🟠Within 24 hours
Recommended Actions
- Identify all Adobe Campaign Classic instances in your environment running version 7.4.4 build 9402 or earlier on Windows and Linux
- Upgrade Adobe Campaign Classic to version 7.4.4 build 9403 immediately following Adobe's release notes and testing procedures
- Review Campaign Classic access logs for suspicious activity including unusual SQL queries, code injection attempts, or privilege escalation patterns prior to patching
- Implement network segmentation to limit Campaign Classic exposure and restrict access to authenticated users only
- Monitor Adobe security bulletins and subscribe to vendor notifications for future Campaign Classic updates