A low-privileged attacker can exploit CVE-2026-105779, a critical SQL injection flaw in Adobe Campaign Classic (CVSS 9.1), over the network to get past security controls and gain unauthorized read access and limited write access.
What Is It
CVE-2026-105779 is an SQL injection vulnerability (CWE-89, Improper Neutralization of Special Elements used in an SQL Command) in Adobe Campaign Classic (ACC). Adobe says the flaw can result in a security feature bypass. An attacker with low privileges could use it to get around security measures and gain unauthorized read access and limited write access.
Adobe PSIRT reported it, and NVD published it on October 27, 2026. The NVD record is in "Received" status.
Why It Matters
Adobe rates the issue 9.1 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L):
- Network-reachable with low attack complexity
- Requires only low privileges
- No user interaction required
- Scope is changed, so the impact can extend beyond the vulnerable component
- High confidentiality impact, with low integrity and availability impact
An authenticated attacker with minimal access can exploit it without anyone else taking action. The main risk is exposure of data the attacker should not be able to read.
What's Vulnerable
- Vendor: Adobe
- Product: Adobe Campaign Classic
- Affected: all versions up to and including 7.4.4 build 9402
- Unaffected: 7.4.4 build 9403
Patch Status
Adobe's vendor data lists Adobe Campaign Classic 7.4.4 build 9403 as unaffected. Adobe has published security bulletin APSB26-162 for this issue.
Organizations running ACC 7.4.4 build 9402 or earlier should review the bulletin and upgrade to build 9403 or later. The critical severity and low barrier to exploitation make prompt patching a priority.