---
id: "CVE-2026-104351"
kind: "vulnerability"
aliases: ["CVE-2026-104351"]
title: "Adobe Campaign Classic: code injection lets a low-privileged user run code"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Adobe Campaign Classic", "fixed": ["7.4.4 build 9403 (unconfirmed)"], "affected": "ACC v7, 7.4.4 build 9402 and earlier (unconfirmed)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-campaign-classic", "code-injection", "hybrid", "on-premise", "other"]
not_affected_if: ["adobe-hosted", "managed-hosting"]
published_at: "2026-10-27T17:16:55+00:00"
first_seen_at: "2026-10-27T17:32:44+00:00"
updated_at: "2026-10-27T17:38:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104351", "first_seen_at": "2026-10-27T17:32:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T17:38:47+00:00"}]
---

# Adobe Campaign Classic: code injection lets a low-privileged user run code

Adobe Campaign Classic code injection (CWE-94-style) letting a low-privileged user run code as the current user. Adobe's October bulletin naming this CVE was not found; sibling ACC code-injection CVEs were fixed in APSB26-142 (build 9402).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Campaign Classic affected ACC v7, 7.4.4 build 9402 and earlier (unconfirmed) fixed 7.4.4 build 9403 (unconfirmed)

## How to check

On-premise/hybrid ACC v7 servers: check build in the console Help > About. Builds up to 9402 are not confirmed fixed for this CVE; build 9403 (Oct 15, 2026) is the newest security build, likely the fix but unconfirmed. Adobe-hosted instances are already remediated per Adobe release notes.

## Fix

Probably upgrade to ACC v7 7.4.4 build 9403 or later (restart nlserver; fix is active by default). Unconfirmed until Adobe's bulletin names the CVE.

## Timeline

- 2026-10-27T17:32:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104351
- 2026-10-27T17:38:47+00:00 analyst — Could not find an Adobe bulletin naming CVE-2026-104351 (not in APSB26-142 or earlier; helpx Campaign page lists none newer than 09/08). Likely fixed by 7.4.4 build 9403 (Oct 15, unnamed 'security improvements' in release notes) but that is inference; nothing marked verified. Re-check helpx Campaign page for an October APSB.

## Documents

- [mentions] Adobe Campaign Classic v7 release notes (builds 9402, 9403) https://experienceleague.adobe.com/en/docs/campaign-classic/using/release-notes/latest-release
- [mentions] APSB26-142 Adobe Campaign Classic (previous bulletin, sibling CVEs) https://www.adobe.com/trust/security/products/campaign/apsb26-142.html

## From the sources

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_