Loading vulnerability…
Reflected XSS in Adobe Campaign Classic
CVE-2026-104350 is a reflected cross-site scripting vulnerability in Adobe Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux. An attacker can inject malicious scripts into a web page by inducing a victim to visit a maliciously crafted URL or interact with a compromised web page. Successful exploitation can provide elevated access to or control over the victim's account or session. The vulnerability has a CVSS v3.1 score of 9.3 with changed security scope.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality and integrity of information accessible through the victim's account or session and potentially enable privilege escalation or account/session takeover. The CVSS assessment assigns high confidentiality and integrity impacts and no availability impact.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic to version 7.4.4 build 9403 or a later vendor-supported release containing the fix. Apply the security update associated with Adobe advisory APSB26-162 to affected Windows and Linux installations.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.