CVE-2026-105489 is a critical SQL injection flaw (CVSS 9.9) in Adobe Campaign Classic. Adobe says successful exploitation could lead to arbitrary code execution. The CVSS vector indicates that a low-privileged attacker could attempt exploitation over the network without any user interaction.
What Is It
CVE-2026-105489 is an Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability, classified as CWE-89, in Adobe Campaign Classic (ACC). Adobe's description says successful exploitation could lead to arbitrary code execution in the context of the current user.
Adobe PSIRT reported the flaw. NVD published it on 2026-10-27, and its record status is currently "Received."
Why It Matters
Adobe rates this flaw CRITICAL with a CVSS v3.1 base score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Key points from the vector:
- Network-reachable: An attacker can exploit it remotely.
- Low attack complexity: No special conditions are needed.
- Low privileges required: An attacker only needs a low-privileged account.
- No user interaction: Nobody needs to click or open anything for the attack to work.
- Scope changed: The impact can reach beyond the vulnerable component.
- High impact: Confidentiality, integrity and availability impacts are all rated High.
The exploitability subscore is 3.1 and the impact subscore is 6.0. Because the vector requires only low privileges, any low-privileged account could potentially be used to attempt exploitation. Organizations that give many users or integrations access to Campaign Classic therefore have more exposure.
The supplied CISA Known Exploited Vulnerabilities (KEV) entry is empty. Based on this data, KEV does not confirm active exploitation of CVE-2026-105489.
What's Vulnerable
According to Adobe's affected-version data:
- Affected: Adobe Campaign Classic versions up to and including 7.4.4 build 9402
- Not affected: Adobe Campaign Classic 7.4.4 build 9403
The NVD record lists no CPE entries for this CVE yet.
Patch Status
Adobe lists Campaign Classic 7.4.4 build 9403 as unaffected, so that build is the fixed version. Adobe published security bulletin APSB26-162 for this issue. Administrators should read the bulletin and upgrade any instance at or below 7.4.4 build 9402.
There is no CISA KEV entry for this CVE, so there is no KEV-mandated required action or due date.