Live › vulnerability › CVE-2026-105781
Go to dashboardAdobe Campaign Classic has an SQL injection flaw that lets an attacker run arbitrary SQL commands through the application. The sources say this can lead to code execution in the context of the current user and control over that user's account or session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
On-premise Adobe Campaign Classic v7 servers, and on-premise parts of hybrid deployments, are the likely scope; Adobe says Adobe-hosted instances have been remediated in its recent ACC bulletins. The CVSS vector (network, no privileges, no user interaction) suggests it can be reached without login, but no Adobe bulletin for this CVE was found, so affected versions are unconfirmed. Teams not running Campaign Classic can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Adobe Campaign Classic | vendor | unknown | – |
7.4.4 build 9403 (release notes)Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
This page as .md · .json · in your agent: get_signal("CVE-2026-105781")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.