Adobe has disclosed a reflected cross-site scripting (XSS) vulnerability, rated CVSS 9.3 (Critical), in Adobe Campaign Classic (ACC) versions up to and including 7.4.4 build 9402.
What Is It
CVE-2026-104350 is a reflected cross-site scripting flaw (CWE-79) in Adobe Campaign Classic. According to Adobe's description, an attacker could use it to inject malicious scripts into a web page. That could give the attacker elevated access to, or control over, the victim's account or session.
The attack needs user interaction. The victim has to visit a maliciously crafted URL or interact with a compromised web page. Adobe notes that the scope is changed, meaning a successful exploit can affect resources beyond the vulnerable component itself.
The NVD record lists this CVE with a status of "Received" as of its publication on October 27, 2026.
Why It Matters
Adobe scored this flaw 9.3 under CVSS 3.1, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. The vector means:
- Network-reachable with low attack complexity
- No privileges required, so an unauthenticated attacker can start the attack
- User interaction required, so a victim has to be lured into clicking or browsing
- Changed scope with high confidentiality and integrity impact
Adobe Campaign Classic is a marketing campaign platform, so session takeover could expose the data and campaign controls available to the victim's account.
As of publication, the CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE. This brief does not confirm active exploitation.
What's Vulnerable
- Vendor: Adobe
- Product: Adobe Campaign Classic (ACC)
- Affected: all versions up to and including 7.4.4 build 9402
- Not affected: 7.4.4 build 9403
Patch Status
Adobe's record lists 7.4.4 build 9403 as unaffected, which indicates that build contains the fix. Organizations running Adobe Campaign Classic should confirm their build number and upgrade to 7.4.4 build 9403 or later.
Adobe's security bulletin APSB26-162 covers this issue and is the reference for remediation guidance. CISA has issued no KEV-mandated required action, because the CISA KEV catalog has no entry for this CVE.