Live › vulnerability › CVE-2026-104354
Go to dashboardAdobe Campaign Classic has an SQL injection flaw that lets a user with high privileges run arbitrary code in the context of the current user. No user interaction is needed and the scope changes, per the NVD record.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
On-premise Adobe Campaign Classic v7 servers and on-premise parts of hybrid deployments are the likely scope; Adobe-hosted instances are normally remediated by Adobe. NVD says the attacker needs high privileges (an authenticated operator account), so risk is mainly from compromised or malicious operator accounts. Teams not running Campaign Classic can skip it. No Adobe bulletin for this CVE was found, so affected versions are unconfirmed.
No product ranges from the sources yet.
7.4.4 build 9401 and earlier for other CVEsUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
This page as .md · .json · in your agent: get_signal("CVE-2026-104354")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.