Threat reportVulnerabilityTL-2026-4582
Adobe Campaign Classic APSB26-162: Multiple Critical Vulnerabilities (CVE-2026-104351, CVE-2026-104353, CVE-2026-105780 and 5 others)
Adobe Campaign Classic APSB26-162 (TL-2026-4582), also tracked as APSB26-162, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-10-28. It has no confirmed attribution, affects Adobe Adobe Campaign Classic (ACC) v7, references 8 CVEs (CVE-2026-104351, CVE-2026-104353, CVE-2026-105780), maps to 4 MITRE ATT&CK techniques (T1059, T1078, T1190), and is covered by 9 detection rules and 4 indicators of compromise.
- CVSS
- 9.9/10Critical
- CVEs
- 8Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 4Indicators of compromise
Key facts for TL-2026-4582
- Threat ID
- TL-2026-4582
- Also known as
- APSB26-162, ESB-2026.13388
- Severity
- CRITICAL
- CVSS
- 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- marketing, retail, finance, telecoms, news - media
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 4
How Adobe Campaign Classic APSB26-162 works
Adobe released APSB26-162 on 2026-10-27 addressing eight critical vulnerabilities in Adobe Campaign Classic v7 (7.4.4 build 9402 and earlier, Windows and Linux), including code injection, OS command injection and incorrect authorization leading to arbitrary code execution (CVSS up to 9.9), plus SQL injection and reflected XSS. Adobe states it is not aware of any exploits in the wild.
Adobe Security Bulletin APSB26-162, published 2026-10-27 with Adobe priority rating 2, fixes eight vulnerabilities that Adobe rates Critical in Adobe Campaign Classic (ACC) v7. All Windows and Linux builds of ACC v7 7.4.4 build 9402 and earlier are affected; the fix is ACC v7 7.4.4 build 9403.
Three flaws lead to arbitrary code execution at CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): CVE-2026-104351 (CWE-94 code injection), CVE-2026-104353 (CWE-78 OS command injection) and CVE-2026-105780 (CWE-863 incorrect authorization). The CVSS vector indicates a network-reachable attack by a low-privileged authenticated user, with no user interaction and a scope change. NVD describes CVE-2026-104351 as code execution in the context of the current user.
Four SQL injection flaws (CWE-89) are listed with a 'security feature bypass' impact: CVE-2026-105489 (9.9), CVE-2026-105781 (9.8, unauthenticated per the vector, PR:N), CVE-2026-104354 (9.1, requires high privileges) and CVE-2026-105779 (9.1). CVE-2026-104350 (CWE-79 reflected XSS, 9.3, UI:R, PR:N) is listed with a 'privilege escalation' impact.
The verified sources do not describe the vulnerable endpoints, the exploit mechanics, or any PoC. Adobe states it is not aware of any exploits in the wild for any of these issues. No network, file or malware IOCs have been published, so the IOC set below is limited to vulnerability, product and build identifiers; BeaconBeagle correlation does not apply because there are no IPs or domains. The AUSCERT bulletin ESB-2026.13388 masks CVE and CVSS details for non-members; the details here come from the Adobe bulletin and NVD. ACC is a marketing-automation platform that holds customer data and executes workflows and JavaScript-based templates, so a compromised server is a high-value target; this context is general product knowledge, not stated in the sources. Earlier ACC bulletins this year (APSB26-120 and APSB26-142, both priority 1) show a recurring pattern of critical ACC fixes.
MITRE ATT&CK techniques used in TL-2026-4582
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Collection
Affected products and versions in Adobe Campaign Classic APSB26-162
- Adobe — Adobe Campaign Classic (ACC) v7
Vulnerable versions: 7.4.4 build 9402 and earlier (Windows, Linux)
Fixed in: 7.4.4 build 9403
Remediation for Adobe Campaign Classic APSB26-162
Patches
- Adobe APSB26-162: ACC v7 7.4.4 build 9403
Immediate actions
- Upgrade all Adobe Campaign Classic v7 instances to 7.4.4 build 9403 (Windows and Linux)
- Inventory ACC servers and confirm build numbers; treat 7.4.4 build 9402 and earlier as vulnerable
- Restrict network access to ACC web and console endpoints to trusted users and networks until patched
- Review ACC and database logs for anomalous SQL, command execution or script activity from low-privileged accounts
Workarounds
- No workaround is stated in the verified sources; limit exposure by network restriction and account hygiene until the update is applied
Longer-term hardening
- Apply the principle of least privilege to ACC operator accounts, since most of the flaws need only low privileges
- Subscribe to Adobe PSIRT bulletins and track ACC updates; several critical ACC bulletins were issued in 2026
- Monitor ACC hosts with EDR for child processes spawned by the ACC application
CVEs associated with Adobe Campaign Classic APSB26-162
CVE-2026-104351, CVE-2026-104353, CVE-2026-105780, CVE-2026-105489, CVE-2026-105781, CVE-2026-104350, CVE-2026-104354, CVE-2026-105779
Weaknesses (CWE) in Adobe Campaign Classic APSB26-162
Timeline of Adobe Campaign Classic APSB26-162
- Adobe publishes APSB26-120 for Campaign Classic with priority rating 1, the first of two earlier critical ACC bulletins in 2026
- Adobe publishes APSB26-142 for Campaign Classic with priority rating 1
- NVD publishes CVE-2026-104351 (CWE-94, CVSS 9.9) referencing APSB26-162
- Fixed version ACC v7 7.4.4 build 9403 released for Windows and Linux; builds 9402 and earlier are affected
- Adobe publishes APSB26-162 (priority 2) addressing eight critical ACC v7 vulnerabilities; Adobe states it is not aware of any exploits in the wild
- AUSCERT publishes ESB-2026.13388 relaying the Adobe bulletin; details are restricted to members
Sources cited for Adobe Campaign Classic APSB26-162
- Adobe Security Bulletin APSB26-162: Security update available for Adobe Campaign Classic
- AUSCERT ESB-2026.13388: Adobe Campaign Classic Security Bulletin
- NVD: CVE-2026-104351
- CISA Known Exploited Vulnerabilities Catalog
- Adobe Security Bulletin APSB26-142 (prior Campaign Classic bulletin)
- Adobe Security Bulletin APSB26-120 (prior Campaign Classic bulletin)
Detection coverage for TL-2026-4582
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4582 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.