9.9
CriticalCVSS 3.1 · from adobe
CVE-2026-105489
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Campaign Classic · SQL injection · CWE-89AffectedAdobe Campaign Classic
FixUpdate to 7.4.4 build 9403 or newer
PublishedOct 27, 17:03 · adobe
ScoredOct 27 · 9.9 · adobe
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
From adobe
Affected and fixed versions
ProductAffectedFixed inAdobe Campaign Classicup to 7.4.4 build 9402–Adobe Campaign ClassicNot affected7.4.4 build 9403
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known