Loading vulnerability…
SQL Injection in Adobe Campaign Classic
CVE-2026-104354 is an SQL injection vulnerability in Adobe Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux. Improper neutralization of special elements in SQL commands allows a highly privileged attacker to exploit the application over the network without user interaction. Successful exploitation can result in arbitrary code execution in the context of the current user and security feature bypass. The vulnerability has a CVSS v3.1 score of 9.1 with changed scope.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow arbitrary code execution with the current user's privileges and bypass of security controls. The CVSS v3.1 assessment indicates high impacts to confidentiality, integrity, and availability, with consequences extending beyond the vulnerable component's security scope.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic to version 7.4.4 build 9403 or a later fixed release. Follow Adobe security advisory APSB26-162 for update and installation guidance.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.