Adobe Campaign Classic up to and including 7.4.4 build 9402 has a critical SQL injection flaw (CVSS 9.1). Adobe says exploiting it could allow a high-privileged attacker to execute arbitrary code.
What Is It
CVE-2026-104354 is an Improper Neutralization of Special Elements used in an SQL Command (SQL injection) vulnerability, classified as CWE-89, in Adobe Campaign Classic (ACC). Adobe's PSIRT reports that exploiting it could let an attacker execute arbitrary code in the context of the current user.
The CVSS v3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. That means:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: High
- User interaction: None
- Scope: Changed
NVD published the record on 2026-10-27. Its status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
The flaw has a base score of 9.1 (CRITICAL), with high impact to confidentiality, integrity and availability. Because the scope is changed, a successful exploit can affect resources beyond the vulnerable component. Exploitation needs high privileges, but it can be done over the network with low complexity and no user interaction. That raises the risk from compromised or malicious privileged accounts.
At the time of writing, this CVE has no CISA Known Exploited Vulnerabilities (KEV) entry. The supplied data does not confirm active exploitation.
What's Vulnerable
- Vendor: Adobe
- Product: Adobe Campaign Classic
- Affected: All versions up to and including 7.4.4 build 9402
- Unaffected: 7.4.4 build 9403
NVD lists no CPE configurations for this record yet.
Patch Status
Adobe's data lists Adobe Campaign Classic 7.4.4 build 9403 as unaffected. Organizations running ACC 7.4.4 build 9402 or earlier should review Adobe security bulletin APSB26-162 and move to build 9403 or later. Because exploitation requires high privileges, administrators should also review who holds privileged access to Campaign Classic until the update is applied.
There is no CISA KEV entry, so no federal required action or due date applies.