Adobe Patches Nine Critical Vulnerabilities in Campaign Classic and Connect

TL;DR

Adobe released two security bulletins on October 27, 2026, resolving nine critical Adobe vulnerabilities across Adobe Campaign Classic and Adobe Connect. The most severe flaws carry a 9.9 CVSS v3.1 score and allow arbitrary code execution, security feature bypass, and privilege escalation. Therefore, system administrators must deploy the Priority 2 updates immediately to secure their installations.

Notable CVEs

Why It Matters

Enterprise organizations and government agencies worldwide rely on Adobe Campaign Classic for cross-channel marketing and Adobe Connect for virtual meetings. Although exact affected installation counts are not specified in the advisories, compromising these platforms exposes sensitive customer databases. Moreover, it also endangers internal communication networks.

In both advisories, the vendor confirms that “Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.” Furthermore, no public proof-of-concept exploit code has been confirmed for any of the nine flaws.

How the Attack Works

The two security bulletins address code injection, operating system command injection, SQL injection, and improper authorization.

Adobe Campaign Classic Flaws

According to the Adobe Campaign Classic APSB26-162 security bulletin, “This update addresses vulnerabilities rated critical that could result in arbitrary code execution, security feature bypass, and privilege escalation.” Three 9.9 CVSS flaws lead to arbitrary code execution: code injection (CVE-2026-104351), OS command injection (CVE-2026-104353), and incorrect authorization (CVE-2026-105780). Additionally, four critical SQL injection bugs (CVE-2026-105489, CVE-2026-105781, CVE-2026-104354, and CVE-2026-105779) allow security feature bypass. Meanwhile, a reflected XSS flaw (CVE-2026-104350, CVSS 9.3) enables privilege escalation.

Adobe Connect Code Injection

Separately, the Adobe Connect APSB26-182 security bulletin notes that “This update resolves a vulnerability rated critical that could result in arbitrary code execution.” Reported by researcher al, CVE-2026-48360 stems from improper control of code generation (CWE-94).

Affected Versions

These Adobe vulnerabilities affect Adobe Campaign Classic v7 (7.4.4 build 9402 and earlier) on Windows and Linux. Meanwhile, CVE-2026-48360 impacts Adobe Connect Desktop on Windows (v2026.8.51 and below), Mac Silicon (v2026.08.45 and below), and Mac Intel (v2026.01.39 and below). It also affects Adobe Connect Mobile 4.4 and earlier for Android.

Patch and Mitigation Steps

Administrators must upgrade Adobe Campaign Classic to v7 version 7.4.4 build 9403. For Adobe Connect, operators should update Windows Desktop to 2026.9.61, Mac Silicon to v2026.10.66, Mac Intel to v2026.10.170, and Android Mobile to version 4.5.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.