10.0
CriticalCVSS 3.1 · from adobe
CVE-2026-105781
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Adobe Campaign Classic · SQL injection · CWE-89AffectedAdobe Campaign Classic
FixUpdate to 7.4.4 build 9403 or newer
PublishedOct 27, 17:03 · adobe
ScoredOct 27 · 10.0 · adobe
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.
From adobe
Affected and fixed versions
ProductAffectedFixed inAdobe Campaign Classicup to 7.4.4 build 9402–Adobe Campaign ClassicNot affected7.4.4 build 9403
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known