Adobe Campaign Classic Vulnerability: 8 Critical Flaws Fixed in APSB26-162, Update to Build 9403
Adobe fixed eight critical flaws in Adobe Campaign Classic, rated up to CVSS 9.9. If you run it on-premise or hybrid, you need 7.4.4 build 9403 and a server restart. Here is what is confirmed and what to check.
Where Worldwide
On this page 9 sections
Adobe has fixed eight critical security flaws in Adobe Campaign Classic, the marketing platform companies use to run email campaigns and hold customer lists. If your company runs Campaign Classic on its own servers (on-premise or hybrid), you need build 9403. The worst of these flaws could let an attacker run their own code on the server that holds your customer data.
What happened with Adobe Campaign Classic
On Tuesday, October 27, 2026, Adobe published security bulletin APSB26-162 for Adobe Campaign Classic (ACC v7). It lists eight vulnerabilities, all rated critical, with CVSS base scores from 9.1 to 9.9. The four most serious each score 9.9, and three of them can lead to arbitrary code execution.
- Affected: Campaign Classic v7, 7.4.4 build 9402 and earlier, on Windows and Linux
- Fixed: 7.4.4 build 9403
Adobe's Campaign Classic release notes list build 9403 as generally available on Thursday, October 15, 2026. The fix was out twelve days before the bulletin explained what it fixed. If your team skipped that build because it looked like routine maintenance, now you know why it matters.
What is confirmed and what is not
Confirmed by Adobe:
- Eight CVEs, all rated critical (full list below).
- Adobe's bulletin says: "Adobe is not aware of any exploits in the wild for any of the issues addressed in this update."
- Adobe rated the update Priority 2, which its rating guide describes as "Act within 30 days."
- The release notes say Adobe-hosted instances "have already been remediated and require no customer action," and that on-premise and hybrid customers should install the update "as soon as possible."
- A restart of the Campaign server (nlserver) is required to load the build.
Not known yet:
- Technical details. Adobe has not published how the flaws work, and the bulletin credits no researchers. We found no public research write-up.
- Whether 7.4.5 build 9420 includes these fixes. The release notes list 7.4.5 build 9420 on the same date, October 15. The bulletin names only 7.4.4 build 9403 as the fix. If you are on the 7.4.5 line or planning to move to it, ask Adobe to confirm it includes the APSB26-162 fixes.
- Other Campaign products. The bulletin lists only Campaign Classic v7. It does not mention Adobe Campaign v8 or Campaign Standard either way.
The eight Adobe Campaign Classic CVEs
The "login needed" column comes from the CVSS vectors Adobe published. It shows what an attacker would need before trying each flaw.
| CVE | Flaw type | Impact | CVSS | Login needed? |
|---|---|---|---|---|
| CVE-2026-104351 | Code injection | Arbitrary code execution | 9.9 | Low-privilege account |
| CVE-2026-104353 | OS command injection | Arbitrary code execution | 9.9 | Low-privilege account |
| CVE-2026-105780 | Incorrect authorization | Arbitrary code execution | 9.9 | Low-privilege account |
| CVE-2026-105489 | SQL injection | Security feature bypass | 9.9 | Low-privilege account |
| CVE-2026-105781 | SQL injection | Security feature bypass | 9.8 | None |
| CVE-2026-104350 | Reflected cross-site scripting (XSS) | Privilege escalation | 9.3 | None, but a user must click a link |
| CVE-2026-104354 | SQL injection | Security feature bypass | 9.1 | High-privilege account |
| CVE-2026-105779 | SQL injection | Security feature bypass | 9.1 | Low-privilege account |
Why the login column matters
Most of the 9.9 flaws need an attacker to have a Campaign account first, but only a low-privilege one. Marketing platforms tend to collect a lot of accounts over time: agency staff, contractors, seasonal help and former employees whose access was never removed. A single phished or reused marketing password could be the starting point for the code execution flaws.
One SQL injection flaw (CVE-2026-105781, CVSS 9.8) needs no login at all over the network. The cross-site scripting flaw (CVE-2026-104350) needs a logged-in user to click a crafted link, which is why phishing awareness for your marketing team is part of this fix too.
Why this matters for a business
Campaign Classic is usually not a side tool. It holds customer names, email addresses, purchase history and segment data, and it sends mail from your company's own domains. Arbitrary code execution means an attacker could run their own commands on that server. On a marketing server, that puts at risk:
- Customer data: the lists and profiles your campaigns depend on, which may trigger breach notification duties if exposed.
- Your sending reputation: mail sent from your real infrastructure looks legitimate to recipients and filters.
- Connected systems: Campaign servers often link to CRM, ecommerce and data warehouse systems, so one compromised server can be a path to others.
The ownership question also matters. Marketing often owns the Campaign platform, while IT owns the servers. Fixes like this fall between the two teams unless someone is clearly responsible.
What to do this week
| Step | What to do | How to check |
|---|---|---|
| 1 | Confirm how you run Campaign Classic | Adobe-hosted, hybrid or on-premise? Check your Adobe contract or ask your implementation partner |
| 2 | Check your build number | 7.4.4 build 9402 or earlier is affected. Ask your Campaign administrator for the build each server reports |
| 3 | Upgrade to 7.4.4 build 9403 | This is the fix Adobe names in APSB26-162. If you use the 7.4.5 line (build 9420), get Adobe's confirmation that it includes these fixes |
| 4 | Restart nlserver | Adobe says a restart is required to load the build. The fix is active by default once restarted |
| 5 | Review Campaign user accounts | Remove former staff, old agency and contractor logins. Reduce rights for accounts that do not need them |
| 6 | Limit what faces the internet | List which Campaign components are reachable from outside. Restrict admin access to VPN or known addresses |
| 7 | Look back at activity | Review logins and configuration changes on Campaign servers since October 15, 2026 |
| 8 | Hosted customers: get it in writing | Ask Adobe or your partner to confirm your instance was remediated, especially for hybrid setups |
Adobe's 30-day window ends on Thanksgiving
Adobe's Priority 2 guidance is to act within 30 days. Counting from the October 27 bulletin, that lands on Thursday, November 26, 2026, which is Thanksgiving. If your change approvals slow down over the holiday, schedule the upgrade and restart now rather than in the final week.
This is also not the first time this year. The release notes show three security builds of 7.4.4 in under two months: build 9401 (August 25), build 9402 (September 11) and build 9403 (October 15). Adobe has marked the first two as deprecated. If your servers are still on 9401 or earlier, you have missed more than one round of fixes.
Adobe Campaign Classic vulnerability questions people are asking
Is the Adobe Campaign Classic vulnerability being exploited?
As of the October 27, 2026 bulletin, Adobe says it is not aware of any exploits in the wild. That can change after a bulletin is published, so do not wait for reports of attacks before patching.
Which version fixes CVE-2026-104351?
Adobe Campaign Classic v7, 7.4.4 build 9403, on Windows and Linux. Build 9402 and earlier are affected.
What is CVE-2026-104351?
It is a code injection flaw rated critical with a CVSS score of 9.9. Adobe says it can lead to arbitrary code execution. Based on Adobe's CVSS vector, an attacker would need a low-privilege account.
Do Adobe-hosted Campaign customers need to do anything?
Adobe says hosted instances have already been remediated and need no customer action. On-premise and hybrid customers must install the update themselves.
Is Adobe Campaign v8 affected?
The bulletin lists only Campaign Classic v7. It does not say whether v8 is affected, so check with Adobe if you run v8.
Why is it Priority 2 if every flaw is critical?
Severity describes how bad a flaw is. Priority is Adobe's advice on how fast to act. Priority 1 is for flaws "being actively exploited or are at higher risk of exploitation." Priority 2 means a high likelihood of exploitation but no known active exploits, with a 30-day window.
Do I need to restart after updating Campaign Classic?
Yes. Adobe's release notes say the Campaign server (nlserver) must be restarted to load build 9403 and complete deployment.
The bigger lesson
Marketing platforms hold some of the most valuable data a company has, yet they are often treated as a marketing tool instead of a server that needs patching. Every system that stores customer data needs a named owner who watches for security bulletins, knows the current build number and has the authority to schedule a restart. If nobody can answer "which build are we on?" in five minutes, fix that before the next bulletin arrives.
Need help keeping business systems patched and locked down? See our security hardening services or request a tech quote.
Get security alerts like this by email, plus our free checklist, at our security alerts page.
Sources: Adobe Security Bulletin APSB26-162; Adobe Campaign Classic latest release notes; Adobe security bulletin priority ratings.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Sega Data Breach: 2.2 Million Email Addresses Leaked Through Email Vendor Arara, What Is Confirmed and What to Check
Sega says 2,196,044 newsletter email addresses leaked in a breach at its email vendor Arara, whose total has g...
Jensen Huang Investigation: NVIDIA's Board Opens a Probe Into a Reported Foreign Intelligence Effort, What Is Confirmed and How to Protect Your Executives
NVIDIA's board has opened an independent investigation after reports that CEO Jensen Huang was a foreign intel...
ArmorSteal Malware: Fake Chocolatey and Activation Tool Sites Steal Passwords and Crypto, and How to Check Your Windows PCs
ArmorSteal is Windows malware spread through fake Chocolatey and Microsoft Activation Scripts pages. It steals...
