---
id: "CVE-2026-104354"
kind: "vulnerability"
aliases: ["CVE-2026-104354"]
title: "Adobe Campaign Classic: SQL injection lets high-privilege users run code"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["adobe-campaign-classic", "authenticated", "self-hosted", "sql-injection", "vendor"]
not_affected_if: ["adobe-hosted"]
published_at: "2026-10-27T17:16:55+00:00"
first_seen_at: "2026-10-27T17:32:45+00:00"
updated_at: "2026-10-27T17:36:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104354", "first_seen_at": "2026-10-27T17:32:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T17:36:11+00:00"}]
---

# Adobe Campaign Classic: SQL injection lets high-privilege users run code

Adobe Campaign Classic has an SQL injection flaw that lets a user with high privileges run arbitrary code in the context of the current user. No user interaction is needed and the scope changes, per the NVD record.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check build in Client Console Help > About. Adobe has not yet published affected versions for this CVE; the newest bulletin (APSB26-142) lists 7.4.4 build 9401 and earlier for other CVEs. Compare against Adobe's next APSB.

## Timeline

- 2026-10-27T17:32:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104354
- 2026-10-27T17:36:11+00:00 analyst — Adobe index (last updated Sep 8) has no bulletin for this CVE; newest APSB26-142 predates it. Versions/fix unknown; nothing verified. Revisit when Adobe publishes an APSB.

## Documents

- [mentions] Adobe Campaign security bulletins index (latest APSB26-142, no entry for CVE-2026-104354) https://helpx.adobe.com/security/products/campaign.html

## From the sources

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_