{"id":"CVE-2026-104351","kind":"vulnerability","aliases":["CVE-2026-104351"],"related":[],"title":"Adobe Campaign Classic: code injection lets a low-privileged user run code","description":"Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe Campaign Classic code injection (CWE-94-style) letting a low-privileged user run code as the current user. Adobe's October bulletin naming this CVE was not found; sibling ACC code-injection CVEs were fixed in APSB26-142 (build 9402).","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Campaign Classic","fixed":["7.4.4 build 9403 (unconfirmed)"],"affected":"ACC v7, 7.4.4 build 9402 and earlier (unconfirmed)","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-campaign-classic","code-injection","hybrid","on-premise","other"],"not_affected_if":["adobe-hosted","managed-hosting"],"how_to_check":"On-premise/hybrid ACC v7 servers: check build in the console Help > About. Builds up to 9402 are not confirmed fixed for this CVE; build 9403 (Oct 15, 2026) is the newest security build, likely the fix but unconfirmed. Adobe-hosted instances are already remediated per Adobe release notes.","fix":"Probably upgrade to ACC v7 7.4.4 build 9403 or later (restart nlserver; fix is active by default). Unconfirmed until Adobe's bulletin names the CVE.","status":"open","published_at":"2026-10-27T17:16:55+00:00","first_seen_at":"2026-10-27T17:32:44+00:00","triaged_at":"2026-10-27T17:34:13+00:00","updated_at":"2026-10-27T17:38:47+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-27T17:34:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Campaign Classic: code injection lets a low-privileged user run code","impact":"high","summary":"Adobe Campaign Classic has a code injection flaw in which unsanitized input is turned into executable code. A low-privileged attacker can run arbitrary code in the context of the current user without any user interaction.","category":"other","nicknames":[],"who_cares":["adobe-campaign-classic"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code as the current user on the server","analyst_note":"Check Adobe's security bulletin for affected ACC versions, patched builds and whether the flaw needs a specific module or setting; the NVD entry gives no versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000506,"input_tokens":3341,"output_tokens":344,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check Adobe's security bulletin for affected ACC versions, patched builds and whether the flaw needs a specific module or setting; the NVD entry gives no versions.","search":"'-104351':16A,19A '-142':74B '-2026':15A,18A '-94':40B '9402':76B 'acc':65B,80C 'adob':1A,24B,34B,54B,77C 'adobe':20A 'adobe-campaign-class':23B 'affect':82C 'apsb26':73B 'arbitrari':98C,119C 'attack':112C 'build':75B 'bulletin':57B 'campaign':2A,21A,25B,35B,78C 'chang':132C 'classic':3A,22A,26B,36B,79C 'code':4A,13A,28B,37B,49B,67B,90C,91C,99C,120C 'code-inject':27B,66B 'context':103C 'control':86C 'could':95C,113C 'current':52B,106C 'cve':14A,17A,60B 'cves':69B 'cwe':39B 'execut':100C,118C 'exploit':114C,121C 'fix':71B 'found':63B 'generat':88C 'hybrid':30B 'improp':85C 'inject':5A,29B,38B,68B,92C 'interact':129C 'issu':124C 'let':6A,42B 'low':9A,45B,110C 'low-privileg':8A,44B,109C 'name':58B 'octob':56B 'on-premis':31B 'premis':33B 'privileg':10A,46B,111C 'requir':127C 'result':96C 'run':12A,48B 'scope':130C 'sibl':64B 'style':41B 'user':11A,47B,53B,107C,128C 'vulner':93C,116C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104351","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104351","severity":null,"published_at":"2026-10-27T17:16:55+00:00","modified_at":"2026-10-27T17:16:55+00:00","first_seen_at":"2026-10-27T17:32:44+00:00","fetched_at":"2026-10-27T17:32:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-104351:900","url":null,"severity":null,"published_at":"2026-10-27T17:38:47+00:00","modified_at":"2026-10-27T17:38:47+00:00","first_seen_at":"2026-10-27T17:38:47+00:00","fetched_at":"2026-10-27T17:38:47+00:00","note":"Could not find an Adobe bulletin naming CVE-2026-104351 (not in APSB26-142 or earlier; helpx Campaign page lists none newer than 09/08). Likely fixed by 7.4.4 build 9403 (Oct 15, unnamed 'security improvements' in release notes) but that is inference; nothing marked verified. Re-check helpx Campaign page for an October APSB."}],"documents":[{"id":7181,"url":"https://experienceleague.adobe.com/en/docs/campaign-classic/using/release-notes/latest-release","title":"Adobe Campaign Classic v7 release notes (builds 9402, 9403)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":7180,"url":"https://www.adobe.com/trust/security/products/campaign/apsb26-142.html","title":"APSB26-142 Adobe Campaign Classic (previous bulletin, sibling CVEs)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}