Adobe fixes eight critical Campaign Classic flaws enabling code execution

Adobe has released patches addressing eight critical flaws in Campaign Classic that could allow arbitrary code execution, security feature bypass, and privilege escalation. The issues are identified by CVEs: CVE-2026-104351 (9.9), CVE-2026-104353 (9.9), CVE-2026-105780 (9.9), CVE-2026-105489 (9.9), CVE-2026-105781 (9.8), CVE-2026-104350 (9.3), CVE-2026-104354 (9.1) and CVE-2026-105779 (9.1).

The affected product is Adobe Campaign Classic version 7.4.4 build 9402 and earlier for Windows and Linux; the fixes ship in version 7.4.4 build 9403. Adobe states these vulnerabilities could be exploited to execute arbitrary code or bypass security features, with some flaws described as SQL injections or improper authorisation that could lead to code execution or privilege escalation. The company notes there is no stated evidence of active exploitation in the wild for these Campaign Classic issues when releasing the patches.

In addition, Adobe resolved a separate critical code injection flaw in Adobe Connect Desktop and Mobile for Windows, macOS and Android (CVE-2026-48360; CVSS 9.6) that could also permit arbitrary code execution. The patched Connect versions are Windows 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170, and Android version 4.5. Adobe emphasises there are no known active exploits for the Connect issue, and users are encouraged to update to the latest software for protection.