Loading vulnerability…
Arbitrary Code Execution via Incorrect Authorization in Adobe Campaign Classic
CVE-2026-105780 is an incorrect authorization vulnerability in Adobe Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux. A low-privileged attacker can exploit the flaw over a network to execute arbitrary code in the context of the current user without user interaction. The vulnerability has a CVSS v3.1 score of 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The affected function and precise authorization failure are not specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality, integrity, and availability through arbitrary code execution with the current user's permissions. The changed-scope rating indicates that exploitation can affect resources beyond the vulnerable component's security authority. Adobe reported no known exploitation in the wild at the time of the update.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic to version 7.4.4 build 9403 or a later fixed release on Windows and Linux. Apply the security update and installation guidance in Adobe bulletin APSB26-162.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.