Loading vulnerability…
SQL Injection in Adobe Campaign Classic
CVE-2026-105489 is an SQL injection vulnerability affecting Adobe Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux. Improper neutralization of special elements in SQL commands allows a low-privileged attacker to exploit the application over the network without user interaction. Successful exploitation can result in arbitrary code execution in the context of the current user and security feature bypass. The vulnerability has a CVSS v3.1 score of 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The specific vulnerable function is not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow arbitrary code execution with the current user's privileges and bypass of security controls. The CVSS assessment indicates changed security scope and high impacts to confidentiality, integrity, and availability.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic to version 7.4.4 build 9403, which fixes this vulnerability on Windows and Linux. Follow Adobe security advisory APSB26-162 for installation instructions.
No public exploits tracked yet. Mallory keeps watching.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.