Adobe has released security patches to address eight critical vulnerabilities in Campaign Classic, affecting versions 7.4.4 build 9402 and earlier.
The vulnerability or weakness
The vulnerabilities include code injection flaws, SQL injection issues, and an incorrect authorization vulnerability, with the most severe having a CVSS score of 9.9 (CVE-2026-104351).
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-104350 | 9.3 | CRITICAL | No | - |
| CVE-2026-104351 | 9.9 | CRITICAL | No | - |
| CVE-2026-104353 | 9.9 | CRITICAL | No | - |
| CVE-2026-104354 | 9.1 | CRITICAL | No | - |
| CVE-2026-105489 | 9.9 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed (2026-10-28)
- HPE Patches Dozens of Critical Flaws in Networking Products (2026-10-27)
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution (2026-10-27)
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw (2026-10-26)
- Linux Flaws Exposed Before Fixes as Root Exploit Goes Public (2026-10-26)
Business impact
Organizations using Campaign Classic are advised to update to the latest version to prevent potential arbitrary code execution and security feature bypass, which could lead to operational disruptions.
Industries affected
This affects businesses in marketing, sales, and customer relationship management.
Users affected
Users should update to the latest version to avoid potential data breaches and ensure the security of their customer data.
