Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass

Adobe released security patches for two product groups: Campaign Classic and Connect. The Campaign Classic fixes address eight vulnerabilities affecting Windows and Linux installations. Adobe Connect Desktop and Mobile received a separate fix for one critical code injection flaw. These updates matter because successful exploitation could allow code execution, bypass security controls, or raise privileges.

Campaign Classic versions 7.4.4 build 9402 and earlier were affected. Adobe fixed those issues in version 7.4.4 build 9403. For Connect, the affected products included Desktop for Windows and macOS and Mobile for Android. The fixed versions are Desktop 2026.9.61 for Windows, 2026.10.66 for macOS Silicon, 2026.10.170 for macOS Intel, and Mobile 4.5 for Android.

Adobe said it was not aware of exploits in the wild for these issues. Even so, users are advised to install the latest versions. Updating closes the documented weaknesses before attackers can potentially use them.

Adobe Campaign Classic is a customer-marketing platform. In general, organizations use it to design campaigns, manage audiences, coordinate messages, and track interactions across channels such as email, mobile, and other digital touchpoints. These capabilities help teams organize large-scale communications from one system. This broader product description comes from established knowledge, because the article focuses on security rather than business functions.

A marketing team might use Campaign Classic to select an audience, prepare a campaign, schedule communications, and manage related customer data. The platform can therefore become important to business operations and may handle sensitive campaign or customer information. The article does not provide a specific customer-use example, so this example is general product context.

The security issue is that Campaign Classic versions 7.4.4 build 9402 and earlier contained eight listed flaws. Adobe patched them in build 9403. Organizations using the platform should identify their installed build and update to the fixed version.

The Campaign Classic update fixed eight vulnerabilities. Four were SQL injection flaws, and two were code injection flaws when the operating-system code injection issue is counted separately from general code injection. The list also included one incorrect authorization flaw and one reflected cross-site scripting flaw. Their CVSS scores ranged from 9.1 to 9.9, placing every listed issue in the critical range described by the article.

Five vulnerabilities had a 9.9 score: CVE-2026-104351, CVE-2026-104353, CVE-2026-105780, CVE-2026-105489, and CVE-2026-105781. The remaining scores were 9.3, 9.1, and 9.1. The stated impacts included arbitrary code execution, security-feature bypass, and privilege escalation.

Adobe also fixed a separate Adobe Connect code injection flaw, CVE-2026-48360, with a CVSS score of 9.6. That issue affected Desktop and Mobile products. Together, the updates address nine vulnerabilities across the two product families.

The most severe stated consequence is arbitrary code execution. It means an attacker may be able to make the affected software run attacker-chosen instructions. The flaws could also enable security-feature bypass, allowing activity to get around protections that should block or restrict it. Privilege escalation could give an attacker greater permissions than the account or action should have.

The article links code injection, operating-system code injection, and incorrect authorization flaws to arbitrary code execution. It links the SQL injection flaws to security-feature bypass. The reflected cross-site scripting flaw could lead to privilege escalation. These are not merely information leaks; they affect what the software can execute, permit, or authorize.

The article does not report any confirmed exploitation. Adobe said it was not aware of exploits in the wild for the addressed issues. However, the high CVSS scores and serious impacts make prompt updating important, because unpatched vulnerabilities can remain available for future attacks.

SQL injection happens when untrusted input is treated as part of a database query. An attacker can manipulate that input to change what the database does. Code injection similarly places attacker-controlled instructions into an application’s processing flow. Operating-system code injection is especially direct because it can target commands handled by the underlying operating system.

Cross-site scripting, or XSS, occurs when a website or application sends untrusted script content to a user’s browser. The browser may then run that content in the application’s context. An authorization flaw occurs when software fails to correctly check whether a user or process is allowed to perform an action. The article identifies one reflected XSS flaw and one incorrect authorization flaw.

These mechanisms explain the listed impacts, but the article does not describe attack steps or affected components. It reports that the flaws could produce arbitrary code execution, security-feature bypass, or privilege escalation. Those outcomes depend on successful exploitation of the vulnerable software.

Arbitrary code execution is dangerous because it lets an attacker cause the affected system to run instructions of the attacker’s choice. The exact result depends on the vulnerable component’s access and environment, but the capability itself is highly powerful. A security-feature bypass is dangerous because it can make a control ineffective, allowing activity that the product intended to prevent.

Privilege escalation creates another serious path. An attacker who starts with limited permissions may gain broader authority if the flaw is exploited. In this update, Adobe linked arbitrary code execution to code injection and incorrect authorization flaws. It linked security-feature bypass to several SQL injection flaws and privilege escalation to reflected cross-site scripting.

The article does not describe specific attacker actions after exploitation. It does establish that all eight Campaign Classic issues had CVSS scores of at least 9.1. Adobe also rated the separate Connect flaw 9.6. Those scores reinforce the need to apply the fixes promptly.

Software patches reduce risk by correcting the flaws identified by the vendor. In this case, Adobe fixed eight Campaign Classic vulnerabilities in build 9403 and fixed the Connect issue in product-specific releases. Installing those versions replaces affected software with versions that address the documented weaknesses. This can reduce exposure to attacks that rely on those flaws.

For example, a Campaign Classic installation on build 9402 or earlier remains within the affected range listed by Adobe. Moving to build 9403 applies the Campaign Classic correction. Connect users must choose the appropriate fixed release: Desktop 2026.9.61 for Windows, 2026.10.66 for macOS Silicon, 2026.10.170 for macOS Intel, or Mobile 4.5 for Android.

Adobe said it was not aware of exploits in the wild. That does not remove the need to update. Unpatched systems remain exposed, and attackers may discover or develop exploitation methods later. Adobe advises users to update for optimal protection.