Live › vulnerability › CVE-2026-104350
Go to dashboardAdobe Campaign Classic has a reflected cross-site scripting flaw, so a crafted URL or compromised page can inject script into a user's browser. An attacker could use that script to take over the victim's account or session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Adobe Campaign Classic v7 on-premise and hybrid on-premise components are the likely exposure, since Adobe says hosted instances are remediated for its bulletins; whether this CVE is covered by that is not confirmed. Exploitation needs a user (e.g. a Campaign operator) to open a crafted URL, so teams whose staff log in to the web UI are at most risk. Versions are unconfirmed until Adobe's bulletin for this CVE is found.
No product ranges from the sources yet.
7.4.4 build 9403 (Oct 15, 2026) and 7.4.5 build 9420, but no source ties this CVE to themUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
This page as .md · .json · in your agent: get_signal("CVE-2026-104350")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.