Adobe Patches 8 Critical Campaign Classic Flaws

Adobe’s latest Campaign Classic update closes eight critical-severity flaws in version 7.4.4 build 9402 and earlier, with CVSS scores running from 9.1 to 10.0. The patch is build 9403, available now for Windows and Linux. Adobe’s advisory APSB26-162 lists no evidence of active exploitation for any of the eight.

The highest-rated flaw, CVE-2026-105781 (CVSS 10.0), is a SQL injection that Adobe classifies as a security feature bypass. Three others, CVE-2026-104351, CVE-2026-104353, and CVE-2026-105780, all score 9.9 and allow arbitrary code execution through code injection and incorrect authorization issues. CVE-2026-105489 (CVSS 9.9) is another SQL injection with a security feature bypass impact. The remaining three cover additional SQL injection paths rated 9.1, CVE-2026-104354 and CVE-2026-105779, plus a reflected XSS issue, CVE-2026-104350 (CVSS 9.3), listed as enabling privilege escalation.

Campaign Classic installations commonly sit adjacent to customer databases and marketing analytics pipelines. A SQL injection at CVSS 10.0 in that context is worth treating as a priority update regardless of the current absence of public exploitation evidence. Adobe’s bulletin classifies this as a priority-1 update.

The same release also covers Adobe Connect: CVE-2026-48360 (CVSS 9.6), a code injection flaw affecting Connect Desktop for Windows, macOS, and Connect Mobile for Android. Fixed versions are 2026.9.61 (Windows Desktop), 2026.10.66 (macOS Silicon Desktop), 2026.10.170 (macOS Intel Desktop), and 4.5 (Android Mobile).

This is the second significant Adobe patch cycle in October. Earlier this week, CISA added two Adobe Commerce and Magento flaws to its KEV catalog after active exploitation evidence emerged. Adobe also patched critical flaws in Campaign Classic and ColdFusion in August. For other enterprise-grade patch batches this week, HPE closed 72 ArubaOS flaws including eight at max severity.

Patch now.