# Adobe Campaign Classic APSB26-162: Multiple Critical Vulnerabilities (CVE-2026-104351, CVE-2026-104353, CVE-2026-105780 and 5 others)

> Adobe released APSB26-162 on 2026-10-27 addressing eight critical vulnerabilities in Adobe Campaign Classic v7 (7.4.4 build 9402 and earlier, Windows and Linux), including code injection, OS command injection and incorrect authorization leading to arbitrary code execution (CVSS up to 9.9), plus SQL injection and reflected XSS. Adobe states it is not aware of any exploits in the wild.

- **Published:** 2026-10-28T00:38:30Z
- **Last reviewed:** 2026-10-28T00:38:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4582
- **ID:** TL-2026-4582
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-104351, CVE-2026-104353, CVE-2026-105780, CVE-2026-105489, CVE-2026-105781, CVE-2026-104350, CVE-2026-104354, CVE-2026-105779

## Description

Adobe Security Bulletin APSB26-162, published 2026-10-27 with Adobe priority rating 2, fixes eight vulnerabilities that Adobe rates Critical in Adobe Campaign Classic (ACC) v7. All Windows and Linux builds of ACC v7 7.4.4 build 9402 and earlier are affected; the fix is ACC v7 7.4.4 build 9403.

Three flaws lead to arbitrary code execution at CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): CVE-2026-104351 (CWE-94 code injection), CVE-2026-104353 (CWE-78 OS command injection) and CVE-2026-105780 (CWE-863 incorrect authorization). The CVSS vector indicates a network-reachable attack by a low-privileged authenticated user, with no user interaction and a scope change. NVD describes CVE-2026-104351 as code execution in the context of the current user.

Four SQL injection flaws (CWE-89) are listed with a 'security feature bypass' impact: CVE-2026-105489 (9.9), CVE-2026-105781 (9.8, unauthenticated per the vector, PR:N), CVE-2026-104354 (9.1, requires high privileges) and CVE-2026-105779 (9.1). CVE-2026-104350 (CWE-79 reflected XSS, 9.3, UI:R, PR:N) is listed with a 'privilege escalation' impact.

The verified sources do not describe the vulnerable endpoints, the exploit mechanics, or any PoC. Adobe states it is not aware of any exploits in the wild for any of these issues. No network, file or malware IOCs have been published, so the IOC set below is limited to vulnerability, product and build identifiers; BeaconBeagle correlation does not apply because there are no IPs or domains. The AUSCERT bulletin ESB-2026.13388 masks CVE and CVSS details for non-members; the details here come from the Adobe bulletin and NVD. ACC is a marketing-automation platform that holds customer data and executes workflows and JavaScript-based templates, so a compromised server is a high-value target; this context is general product knowledge, not stated in the sources. Earlier ACC bulletins this year (APSB26-120 and APSB26-142, both priority 1) show a recurring pattern of critical ACC fixes.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1213 Data from Information Repositories

## Sources

- [Adobe Security Bulletin APSB26-162: Security update available for Adobe Campaign Classic](https://www.adobe.com/trust/security/products/campaign/apsb26-162)
- [AUSCERT ESB-2026.13388: Adobe Campaign Classic Security Bulletin](http://portal.auscert.org.au/bulletins/ESB-2026.13388/)
- [NVD: CVE-2026-104351](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-104351)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Adobe Security Bulletin APSB26-142 (prior Campaign Classic bulletin)](https://helpx.adobe.com/nz/security/products/campaign/apsb26-142.html)
- [Adobe Security Bulletin APSB26-120 (prior Campaign Classic bulletin)](https://helpx.adobe.com/au/security/products/campaign/apsb26-120.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4582