Adobe has disclosed a critical SQL injection vulnerability in Adobe Campaign Classic (ACC) that an unauthenticated attacker can reach over the network, with impacts up to arbitrary code execution.
What Is It
CVE-2026-105781 is an Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability (CWE-89) in Adobe Campaign Classic. Adobe's description says an attacker could use it to run arbitrary SQL commands, which could give them elevated access or control over the victim's account or session. Adobe also says it could lead to arbitrary code execution in the context of the current user.
Exploitation does not require user interaction, and the scope is changed. Adobe PSIRT submitted the record, and NVD published it on 2026-10-27. Its NVD status is currently "Received."
Why It Matters
Adobe rates this CVE at the top of the CVSS scale:
- CVSS 3.1 Base Score: 10.0 (CRITICAL)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Exploitability Score: 3.9 | Impact Score: 6.0
The vector shows that the flaw is reachable over the network with low attack complexity. It requires no privileges and no user interaction. The impact on confidentiality, integrity, and availability is high, and the changed scope means a successful attack can affect resources beyond the vulnerable component.
At the time of writing, this CVE has no entry in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation.
What's Vulnerable
According to Adobe's affected-product data:
| Product | Affected | Unaffected |
|---|---|---|
| Adobe Campaign Classic | All versions up to and including 7.4.4 build 9402 | 7.4.4 build 9403 |
The NVD record lists no CPE entries yet.
Patch Status
Adobe's data lists Adobe Campaign Classic 7.4.4 build 9403 as unaffected, so organizations running ACC should move to that build or later. Adobe security bulletin APSB26-162 has the vendor guidance.
Because this CVE is not in the KEV catalog, there is no CISA-mandated action or due date for it. Even so, an unauthenticated, network-reachable SQL injection with a CVSS score of 10.0 should be patched on an urgent timeline.