Adobe says a critical code injection vulnerability in Adobe Campaign Classic could allow a low-privileged attacker to execute arbitrary code over the network, without any user interaction.
What Is It
CVE-2026-104351 is an Improper Control of Generation of Code ("Code Injection") vulnerability in Adobe Campaign Classic (ACC), tracked as CWE-94. Adobe's description in the NVD record says successful exploitation could result in arbitrary code execution in the context of the current user. Adobe also says a low-privileged attacker could exploit the flaw and that no user interaction is needed. It rates the scope as changed, which means the impact can reach beyond the vulnerable component.
Adobe PSIRT reported the vulnerability. It was published to NVD on October 27, 2026. Its NVD status is currently "Received," so NVD has not yet finished its own analysis.
Why It Matters
Adobe gave the flaw a CVSS 3.1 base score of 9.9 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. That vector means:
- It is reachable over the network and has low attack complexity
- It needs only low privileges and no user interaction
- The scope is changed, with high impact to confidentiality, integrity and availability
The exploitability subscore is 3.1 and the impact subscore is 6.0. Based on this rating, an attacker with a low-privileged account on an exposed ACC instance could potentially gain code execution.
This CVE was not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing, so KEV does not confirm active exploitation at this time.
What's Vulnerable
According to Adobe's affected-version data:
- Affected: Adobe Campaign Classic versions up to and including 7.4.4 build 9402
- Unaffected: Adobe Campaign Classic 7.4.4 build 9403
The NVD record does not list any specific CPEs.
Patch Status
Adobe lists 7.4.4 build 9403 as unaffected. If you run Adobe Campaign Classic 7.4.4 build 9402 or earlier, review Adobe security bulletin APSB26-162 and move to a fixed build. The bulletin link below is the one referenced for this CVE. If it does not resolve, look up APSB26-162 on Adobe's Product Security Bulletins page, where Adobe normally publishes its security bulletins. The flaw is rated critical and needs only low privileges, so administrators should prioritize this update, especially on internet-facing deployments.
The CVE is not currently listed in the CISA KEV catalog, so there is no CISA-mandated required action or due date.