{"id":"CVE-2026-105781","kind":"vulnerability","aliases":["CVE-2026-105781"],"related":[],"title":"Adobe Campaign Classic: SQL injection lets attackers run arbitrary commands","description":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.","summary":"Adobe Campaign Classic has an SQL injection flaw that lets an attacker run arbitrary SQL commands through the application. The sources say this can lead to code execution in the context of the current user and control over that user's account or session.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Adobe Campaign Classic","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-campaign-classic","self-hosted","sql-injection","unauthenticated","vendor"],"not_affected_if":["adobe-hosted"],"how_to_check":"Check build in Client Console Help > About. Unknown whether your build is affected; Adobe has not published affected versions for this CVE that I could find. Latest security build is 7.4.4 build 9403 (release notes).","fix":null,"status":"open","published_at":"2026-10-27T17:16:56+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:11+00:00","updated_at":"2026-10-27T17:35:35+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-10-27T17:34:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Adobe Campaign Classic: SQL injection lets attackers run arbitrary commands","impact":"high","summary":"Adobe Campaign Classic has an SQL injection flaw that lets an attacker run arbitrary SQL commands through the application. The sources say this can lead to code execution in the context of the current user and control over that user's account or session.","category":"vendor","nicknames":[],"who_cares":["adobe-campaign-classic","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary SQL and code, takes over user session","analyst_note":"Find Adobe's security bulletin for affected and fixed ACC versions, the vulnerable endpoint, and whether authentication is required.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Adobe Campaign Classic (ACC) are affected. The sources do not list affected versions or the specific entry points, so the team should confirm against Adobe's advisory. Teams not running Adobe Campaign Classic can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000555,"input_tokens":3374,"output_tokens":435,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Adobe's security bulletin for affected and fixed ACC versions, the vulnerable endpoint, and whether authentication is required.","search":"'-105781':13A,16A '-2026':12A,15A 'acc':79C 'access':125C 'account':73B,132C 'adob':1A,21B,32B,76C 'adobe':17A 'adobe-campaign-class':20B 'affect':81C 'applic':50B 'arbitrari':9A,45B,101C,119C 'attack':7A,43B,112C 'campaign':2A,18A,22B,33B,77C 'chang':146C 'classic':3A,19A,23B,34B,78C 'code':58B,102C 'command':10A,47B,93C,121C 'context':62B,106C 'control':68B,127C 'could':98C,113C 'current':65B,109C 'cve':11A,14A 'element':88C 'elev':124C 'execut':59B,103C,118C 'exploit':114C,135C 'flaw':39B 'gain':123C 'host':26B 'improp':84C 'inject':5A,29B,38B,95C 'interact':143C 'issu':138C 'lead':56B 'let':6A,41B 'neutral':85C 'potenti':122C 'requir':141C 'result':99C 'run':8A,44B 'say':53B 'scope':144C 'self':25B 'self-host':24B 'session':75B,134C 'sourc':52B 'special':87C 'sql':4A,28B,37B,46B,92C,94C,120C 'sql-inject':27B 'unauthent':30B 'use':89C 'user':66B,71B,110C,142C 'vendor':31B 'victim':130C 'vulner':96C,116C","nicknames":[],"mitigations":[],"who_affected":"On-premise Adobe Campaign Classic v7 servers, and on-premise parts of hybrid deployments, are the likely scope; Adobe says Adobe-hosted instances have been remediated in its recent ACC bulletins. The CVSS vector (network, no privileges, no user interaction) suggests it can be reached without login, but no Adobe bulletin for this CVE was found, so affected versions are unconfirmed. Teams not running Campaign Classic can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105781","severity":null,"published_at":"2026-10-27T17:16:56+00:00","modified_at":"2026-10-27T17:16:56+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105781:894","url":null,"severity":null,"published_at":"2026-10-27T17:35:35+00:00","modified_at":"2026-10-27T17:35:35+00:00","first_seen_at":"2026-10-27T17:35:35+00:00","fetched_at":"2026-10-27T17:35:35+00:00","note":"Adobe bulletin for this CVE not found (checked Trust Center, helpx campaign list, APSB26-142/134, release notes); CVE is absent from APSB26-142's 18 CVEs. CVSS 10.0 vector from Adobe PSIRT is AV:N/PR:N/UI:N, so likely unauthenticated, but endpoint/versions/fix unknown. Latest ACC security build is 7.4.4 build 9403 (2026-10-15), not tied to this CVE by Adobe. No exploitation reported. Nothing verified. Revisit when Adobe publishes the APSB."}],"documents":[{"id":7180,"url":"https://www.adobe.com/trust/security/products/campaign/apsb26-142.html","title":"APSB26-142 Adobe Campaign Classic (previous bulletin, sibling CVEs)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":7181,"url":"https://experienceleague.adobe.com/en/docs/campaign-classic/using/release-notes/latest-release","title":"Adobe Campaign Classic v7 release notes (builds 9402, 9403)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}