Loading vulnerability…
Code Injection in Adobe Campaign Classic
CVE-2026-104351 is a code injection vulnerability in Adobe Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux. Improper control of code generation allows a low-privileged attacker to execute arbitrary code over the network in the context of the current user, without user interaction. The vulnerability has a CVSS v3.1 score of 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The specific vulnerable function and input are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause high impacts to confidentiality, integrity, and availability through arbitrary code execution in the context of the current user. Changed scope indicates that exploitation can affect resources beyond the vulnerable component's security authority. Exploitation does not inherently establish administrative or system-level execution.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. As defense-in-depth measures pending patching, restrict network access to affected Campaign Classic deployments and limit access by low-privileged accounts. These controls do not replace the vendor update.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic to version 7.4.4 build 9403 or a later vendor-supported fixed release. Adobe security bulletin APSB26-162 documents the applicable update.
No public exploits tracked yet. Mallory keeps watching.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.