---
id: "CVE-2026-105781"
kind: "vulnerability"
aliases: ["CVE-2026-105781"]
title: "Adobe Campaign Classic: SQL injection lets attackers run arbitrary commands"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Adobe Campaign Classic", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-campaign-classic", "self-hosted", "sql-injection", "unauthenticated", "vendor"]
not_affected_if: ["adobe-hosted"]
published_at: "2026-10-27T17:16:56+00:00"
first_seen_at: "2026-10-27T17:32:45+00:00"
updated_at: "2026-10-27T17:35:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105781", "first_seen_at": "2026-10-27T17:32:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T17:35:35+00:00"}]
---

# Adobe Campaign Classic: SQL injection lets attackers run arbitrary commands

Adobe Campaign Classic has an SQL injection flaw that lets an attacker run arbitrary SQL commands through the application. The sources say this can lead to code execution in the context of the current user and control over that user's account or session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Campaign Classic affected unknown fixed ?

## How to check

Check build in Client Console Help > About. Unknown whether your build is affected; Adobe has not published affected versions for this CVE that I could find. Latest security build is 7.4.4 build 9403 (release notes).

## Timeline

- 2026-10-27T17:32:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105781
- 2026-10-27T17:35:35+00:00 analyst — Adobe bulletin for this CVE not found (checked Trust Center, helpx campaign list, APSB26-142/134, release notes); CVE is absent from APSB26-142's 18 CVEs. CVSS 10.0 vector from Adobe PSIRT is AV:N/PR:N/UI:N, so likely unauthenticated, but endpoint/versions/fix unknown. Latest ACC security build is 7.4.4 build 9403 (2026-10-15), not tied to this CVE by Adobe. No exploitation reported. Nothing verified. Revisit when Adobe publishes the APSB.

## Documents

- [mentions] APSB26-142 Adobe Campaign Classic (previous bulletin, sibling CVEs) https://www.adobe.com/trust/security/products/campaign/apsb26-142.html
- [mentions] Adobe Campaign Classic v7 release notes (builds 9402, 9403) https://experienceleague.adobe.com/en/docs/campaign-classic/using/release-notes/latest-release

## From the sources

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_