Adobe patches nine flaws in Campaign Classic and Connect

Adobe has issued security bulletins addressing nine critical vulnerabilities across Adobe Campaign Classic and Adobe Connect, with updates released on 27 October 2026. The flaws include several high-severity code execution and bypass issues, the most severe rated at CVSS v3.1 10.0. The vendor says there are no known exploits in the wild for these issues at publication, and no public PoCs have been confirmed.

The affected product set comprises Adobe Campaign Classic v7 (7.4.4 build 9402 and earlier) on Windows and Linux, and Adobe Connect Desktop on Windows, Mac (Silicon and Intel), and Adobe Connect Mobile for Android.

Notable vulnerabilities include three 9.9 CVSS flaws in Campaign Classic that could enable arbitrary code execution via code injection (CVE-2026-104351), OS command injection (CVE-2026-104353), and incorrect authorization (CVE-2026-105780). Four SQL injection issues in Campaign Classic could allow security feature bypass (CVE-2026-105489, CVE-2026-105781, CVE-2026-104354, CVE-2026-105779), while a reflected XSS vulnerability could permit privilege escalation (CVE-2026-104350, CVSS 9.3).

In Adobe Connect, CVE-2026-48360 stems from improper control of code generation (CWE-94) and could lead to arbitrary code execution. Patches require Campaign Classic to version 7.4.4 build 9403, and Connect updates to Windows Desktop 2026.9.61, Mac Silicon 2026.10.66, Mac Intel 2026.10.170, and Android Mobile 4.5. The advisories state these fixes are available and should be applied promptly.