{"id":"CVE-2026-104354","kind":"vulnerability","aliases":["CVE-2026-104354"],"related":[],"title":"Adobe Campaign Classic: SQL injection lets high-privilege users run code","description":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe Campaign Classic has an SQL injection flaw that lets a user with high privileges run arbitrary code in the context of the current user. No user interaction is needed and the scope changes, per the NVD record.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe-campaign-classic","authenticated","self-hosted","sql-injection","vendor"],"not_affected_if":["adobe-hosted"],"how_to_check":"Check build in Client Console Help > About. Adobe has not yet published affected versions for this CVE; the newest bulletin (APSB26-142) lists 7.4.4 build 9401 and earlier for other CVEs. Compare against Adobe's next APSB.","fix":null,"status":"open","published_at":"2026-10-27T17:16:55+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:19+00:00","updated_at":"2026-10-27T17:36:11+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-10-27T17:34:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Campaign Classic: SQL injection lets high-privilege users run code","impact":"high","summary":"Adobe Campaign Classic has an SQL injection flaw that lets a user with high privileges run arbitrary code in the context of the current user. No user interaction is needed and the scope changes, per the NVD record.","category":"vendor","nicknames":[],"who_cares":["adobe-campaign-classic","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker with high privileges runs arbitrary code on the server","analyst_note":"Check Adobe's security bulletin for affected ACC versions, patched builds and any mitigation; the NVD entry lacks version and fix details.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00051,"input_tokens":3354,"output_tokens":349,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check Adobe's security bulletin for affected ACC versions, patched builds and any mitigation; the NVD entry lacks version and fix details.","search":"'-104354':15A,18A '-2026':14A,17A 'acc':72C 'adob':1A,20B,31B,69C 'adobe-campaign-class':19B 'affect':74C 'arbitrari':47B,94C,115C 'attack':105C 'authent':23B 'campaign':2A,21B,32B,70C 'chang':64B,128C 'classic':3A,22B,33B,71C 'code':12A,48B,95C,116C 'command':86C 'context':51B,99C 'could':91C,109C 'current':54B,102C 'cve':13A,16A 'element':81C 'execut':96C,114C 'exploit':110C,117C 'flaw':38B 'high':8A,44B,107C 'high-privileg':7A 'host':26B 'improp':77C 'inject':5A,29B,37B,88C 'interact':58B,125C 'issu':120C 'let':6A,40B 'need':60B 'neutral':78C 'nvd':67B 'per':65B 'privileg':9A,45B,108C 'record':68B 'requir':123C 'result':92C 'run':11A,46B 'scope':63B,126C 'self':25B 'self-host':24B 'special':80C 'sql':4A,28B,36B,85C,87C 'sql-inject':27B 'use':82C 'user':10A,42B,55B,57B,103C,124C 'vendor':30B 'vulner':89C,112C","nicknames":[],"mitigations":[],"who_affected":"On-premise Adobe Campaign Classic v7 servers and on-premise parts of hybrid deployments are the likely scope; Adobe-hosted instances are normally remediated by Adobe. NVD says the attacker needs high privileges (an authenticated operator account), so risk is mainly from compromised or malicious operator accounts. Teams not running Campaign Classic can skip it. No Adobe bulletin for this CVE was found, so affected versions are unconfirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104354","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104354","severity":null,"published_at":"2026-10-27T17:16:55+00:00","modified_at":"2026-10-27T17:16:55+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-104354:898","url":null,"severity":null,"published_at":"2026-10-27T17:36:11+00:00","modified_at":"2026-10-27T17:36:11+00:00","first_seen_at":"2026-10-27T17:36:11+00:00","fetched_at":"2026-10-27T17:36:11+00:00","note":"Adobe index (last updated Sep 8) has no bulletin for this CVE; newest APSB26-142 predates it. Versions/fix unknown; nothing verified. Revisit when Adobe publishes an APSB."}],"documents":[{"id":7184,"url":"https://helpx.adobe.com/security/products/campaign.html","title":"Adobe Campaign security bulletins index (latest APSB26-142, no entry for CVE-2026-104354)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}