CybersecurityVulnerability Management

Adobe Patches Flaws in Campaign Classic, Connect Software

Analyst 207||Source: TheHackerNews
Modern software development workstation with laptop and large monitor on a clean desk.

"Adobe said it's not 'aware of any exploits in the wild for any of the issues' addressed in the update." That caveat came with a set of urgent patches that fix multiple critical flaws in Adobe Campaign Classic and a separate critical bug in Adobe Connect.

Eight CVEs in Adobe Campaign Classic

Adobe released fixes for eight separate vulnerabilities in Campaign Classic. The company lists the issues and their impacts as follows:

  • CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution.
  • CVE-2026-104353 (CVSS score: 9.9) - An operating system code injection vulnerability that could lead to arbitrary code execution.
  • CVE-2026-105780 (CVSS score: 9.9) - An incorrect authorization vulnerability that could lead to arbitrary code execution.
  • CVE-2026-105489 (CVSS score: 9.9) - An SQL injection vulnerability that could lead to security feature bypass.
  • CVE-2026-105781 (CVSS score: 9.8) - An SQL injection vulnerability that could lead to security feature bypass.
  • CVE-2026-104350 (CVSS score: 9.3) - A reflected cross-site scripting vulnerability that could lead to privilege escalation.
  • CVE-2026-104354 (CVSS score: 9.1) - An SQL injection vulnerability that could lead to security feature bypass.
  • CVE-2026-105779 (CVSS score: 9.1) - An SQL injection vulnerability that could lead to security feature bypass.

Affected versions and the patch build

The Campaign Classic issues affect Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux. Adobe patched the vulnerabilities in version 7.4.4 build 9403. Adobe's public guidance is to update to the latest version for optimal protection.

Adobe Connect Desktop and Mobile fix (CVE-2026-48360)

Separately, Adobe resolved a critical code injection flaw in Adobe Connect Desktop and Mobile across multiple platforms. The vulnerability is tracked as CVE-2026-48360 (CVSS score: 9.6) and could result in arbitrary code execution. The fixes were released in the following product versions:

  • Adobe Connect Desktop — Windows: version 2026.9.61
  • Adobe Connect Desktop — macOS Silicon: version 2026.10.66
  • Adobe Connect Desktop — macOS Intel: version 2026.10.170
  • Adobe Connect Mobile for Android: version 4.5

Severity, scores, and the nature of impact

Adobe assigned very high CVSS scores to the Campaign Classic vulnerabilities: four issues are rated 9.9, one is 9.8, one is 9.3, and two are 9.1. Several of the highest-scored flaws are described as code injection or incorrect-authorization issues that could lead to arbitrary code execution. Multiple SQL injection flaws are listed as capable of leading to security feature bypass, and a reflected cross-site scripting flaw is described as capable of privilege escalation.

What this means for technologists, affected enterprises, and end users

  • Technologists and security teams: Patch Campaign Classic installations running versions up to 7.4.4 build 9402 by applying build 9403, and update Adobe Connect Desktop and Android Mobile to the fixed versions listed above to eliminate the documented code-injection and SQL-injection vectors.
  • Affected enterprises and procurement leaders: Confirm which instances run Adobe Campaign Classic 7.4.4 build 9402 or earlier on Windows and Linux and schedule expedited updates; verify that Adobe Connect clients are updated to the Windows, macOS, and Android builds Adobe published.
  • End users and administrators of Connect: Install the updated Connect Desktop and Android Mobile builds to align client software with the patched releases and follow Adobe's advisory to update to the latest versions for optimal protection.

Adobe's explicit note that it is not aware of active exploitation does not change the technical severity the vendor assigned to these flaws. The concrete next step the company provides — and the single concrete mitigation in the bulletin — is to update to the patched builds: Campaign Classic 7.4.4 build 9403 and the listed Adobe Connect Desktop and Mobile versions. Administrators and users who run these products will need to confirm they have applied those releases to remove the attack surface described in the advisories.

Original report: https://thehackernews.com/2026/10/adobe-fixes-8-critical-campaign-classic.html

Emerging ThreatsPatch ManagementSoftware VulnerabilitiesVulnerability ManagementCampaign ClassicAdobe PatchesConnect SoftwareCVE-2026-104351CVE-2026-104353CVE-2026-105780
Related Intelligence

Continue Reading

Researcher stands beside computer screen displaying code, analyzing AI agent behavior in a bright laboratory setting.

Cisco Unveils Tool to Track Rogue AI Agents

Cisco's new tool, Project Quarry, helps detect rogue AI agents by monitoring their behavior and flagging suspicious multi-step activity that could indicate misuse or compromise. This open-source engine provides a shared language for identifying potential threats, giving organizations an upper hand in the fight against AI-powered attacks.

Analyst 207
Lab equipment surrounds computer workstations with distorted patterns on screens.

Anthropic AI Model Chains Flaws Into Browser, OS Exploits

Anthropic's AI model has made a groundbreaking discovery, autonomously uncovering security flaws in major browsers and operating systems, and chaining them into working exploits with minimal human input. This remarkable achievement has led to crucial patches being deployed across Chrome, Safari, Android, Windows, and Linux.

Analyst 207
Unix socket on a server with a blurred data center background.

Tailscale Fixes SSH Flaws That Exposed Root Access Risk

Tailscale's SSH system had a vulnerability that allowed attackers to gain root access, as demonstrated by a simple test that produced a root shell and read the system password file without admin rights. The flaw was rooted in how Tailscale handled socket forwarding, which was quickly patched once discovered.

Analyst 207
Rural hospital corridor with staff and security device on shelf.

US Cyber Chief Launches Pilot to Bolster Rural Hospital Defenses

The US Cyber Chief has launched Project Lifeline 250, a game-changing pilot program that supercharges rural hospital defenses by connecting them with top-notch American tech and tools. This six-month initiative helps safeguard hospital networks, deploy backup devices, and upgrade high-risk equipment to ensure rural communities get the critical care they need.

Analyst 207