Adobe patches eight critical Campaign Classic flaws; build 9403 fixes the reported exposure

Adobe fixes eight critical Campaign Classic flaws

Adobe released security updates addressing eight critical vulnerabilities in Campaign Classic, with CVSS scores ranging from 9.1 to 9.9. According to reporting published on October 28 and October 29, the affected product is Adobe Campaign Classic version 7.4.4 build 9402 and earlier on Windows and Linux; Adobe addressed the flaws in version 7.4.4 build 9403. The reported consequences include arbitrary code execution, security-feature bypass and privilege escalation. The flaws do not establish that any exploitation has occurred.

Four issues received a CVSS score of 9.9: code injection flaws CVE-2026-104351 and CVE-2026-104353, an incorrect-authorization flaw identified as CVE-2026-105780, and SQL injection flaw CVE-2026-105489. The reporting separately identifies three issues that could lead to code execution, four that could enable a security bypass and one that could permit privilege escalation.

Organizations advised to deploy the fixed build

The available reporting advised organizations to check the build numbers installed on affected systems and prioritize deployment of Campaign Classic build 9403, particularly on internet-facing or high-value systems. This is a recommendation to update systems, not evidence of a completed customer rollout.

The vulnerabilities affect a product used for enterprise email and cross-channel marketing. Reporting said Campaign Classic can hold subscriber lists, campaign templates and delivery logs, making the reported injection exposure relevant to customer data. That description establishes the product’s potential data relationship, but does not quantify affected installations, customer demand or completed deployments.

Adobe Connect fix included a separate client flaw

The same update round addressed critical code injection vulnerability CVE-2026-48360 in Adobe Connect Desktop and Mobile clients. The reporting assigned it a CVSS score of 9.6 and described arbitrary code execution on the client machine as the potential impact.

The listed fixed releases were Connect Desktop 2026.9.61 for Windows, 2026.10.66 for macOS systems using Apple silicon, 2026.10.170 for macOS systems using Intel processors, and Connect Mobile 4.5 for Android. One report also described the client exposure as affecting Windows, macOS and Android, while the other report specified Windows and Android in its abbreviated summary.

Exploitation status remains bounded

The October 29 report said Adobe was not aware of exploitation in the wild for the issues in the update. The October 28 report similarly characterized the situation as a window to patch, but did not provide evidence of a completed remediation campaign. No reviewed report established that customer installations had been updated or that exploitation had occurred.

Relevant verification point

Administrators can determine whether they are running an affected Campaign Classic build by checking their installed version against Adobe advisory APSB26-162. The next verifiable point is whether customer deployments move from build 9402 or earlier to build 9403, along with any subsequent disclosure of exploitation.