Loading vulnerability…
SQL Injection in Adobe Campaign Classic
CVE-2026-105781 is an SQL injection vulnerability in Adobe Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux. Improper neutralization of SQL special elements allows an attacker to execute arbitrary SQL commands, potentially bypass security controls, and execute arbitrary code in the context of the current user. Exploitation requires no privileges or user interaction and can cross security boundaries. The specific vulnerable function is not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could bypass security controls, expose or modify database information, and disrupt availability. Arbitrary SQL execution may enable elevated access or control over a victim's account or session, with potential arbitrary code execution under the current user's privileges. The recorded CVSS v3.1 vector indicates high confidentiality, integrity, and availability impacts and changed scope.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic on Windows and Linux to version 7.4.4 build 9403 or a later vendor-supported release incorporating the fix. Follow Adobe security advisory APSB26-162 for update and installation guidance.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.