What Adobe’s APSB26-162 Fixes: Eight Critical Campaign Classic Flaws, Four Rated 9.9

Adobe has fixed eight critical vulnerabilities in Adobe Campaign Classic in security bulletin APSB26-162. The bulletin is dated Oct. 27, 2026. Four of the eight flaws carry a CVSS score of 9.9. Three of those four allow arbitrary code execution, and the fourth allows a security feature bypass.

The same date carries a separate Adobe bulletin for Adobe Connect, covered later in this article. Adobe’s Experience League introduction, which applies to Campaign Classic v7, aims to help readers understand how the product fits into the Adobe Digital Experience portfolio. The page’s topic tags are Campaigns, Integrations and Administration. The campaign bulletin covers Windows and Linux installations and names build 9403 as the fixed version.

Eight Critical Flaws, Four Rated 9.9

The bulletin lists eight CVEs, all rated critical. The first two of the four rated 9.9 are CVE-2026-104351, a code injection flaw, and CVE-2026-104353, an OS command injection flaw. Both allow arbitrary code execution. The third is CVE-2026-105780, an incorrect authorization flaw with the same impact. The fourth, CVE-2026-105489, is a SQL injection flaw that Adobe classifies as a security feature bypass.

The remaining four sit lower in the range. CVE-2026-105781 is a SQL injection flaw rated 9.8 that could lead to a security feature bypass. CVE-2026-104350, rated 9.3, is a reflected cross-site scripting flaw that could lead to privilege escalation. CVE-2026-104354 and CVE-2026-105779 are both SQL injection flaws rated 9.1, and Adobe’s vector for CVE-2026-104354 requires high privileges to exploit.

Seven of the eight need no user interaction to be exploited. The exception is CVE-2026-104350, which requires a user to act. Adobe’s vector strings mark the scope as changed for all eight flaws, and the scores run from 9.1 to 9.9. The Hacker News report lists the same eight CVE numbers, scores and impact categories.

The Bulletin in One Line
Adobe’s bulletin APSB26-162, dated Oct. 27, 2026, lists eight critical Campaign Classic CVEs and fixes them in version 7.4.4 build 9403 for Windows and Linux.

What Each Flaw Class Allows

The three code-execution flaws each carry a different Common Weakness Enumeration (CWE) entry, and MITRE’s definitions describe what those entries mean. CWE-94, the code injection class, covers code built from outside data without filtering the characters that could change what the code does. An attacker can use that gap to insert their own commands.

CWE-78 applies the same pattern to operating system commands. A program assembles a command from untrusted data without filtering shell characters, so an attacker can alter the command and run their own instructions. CWE-863 covers a check that exists but is carried out incorrectly, so unauthorized access can get through.

Four of the eight flaws are SQL injection, classed as CWE-89. In that class, a database query is built from outside input without neutralizing SQL special characters, so the input can run as database commands. Adobe lists all four as security feature bypasses, and their scores range from 9.1 to 9.9.

The reflected cross-site scripting flaw, CVE-2026-104350, falls under CWE-79. That entry covers user-supplied data inserted into a page without adequate sanitizing, so attacker code can run in the browsers of other users. Adobe lists its impact as privilege escalation, and it is the only one of the eight that needs a user to act.

The bulletin names eight critical flaws, but it does not say what customer data they could reach.

Which Versions and Builds Are Covered

The affected builds are version 7.4.4 build 9402 and earlier, on Windows and Linux. Build 9403 is the fixed version for both platforms. The bulletin lists its priority rating as 2.

The affected range therefore covers every build up to and including 9402 on those platforms. The bulletin also recommends that users update their installation to the newest version.

Adobe’s release notes date build 9403, which they list as release 7.4.4, to Oct. 15, 2026. They say the build includes security updates for critical vulnerabilities.

Deployment Guidance and Exploit Status

Adobe’s release notes say Adobe encourages on-premise and hybrid customers to install the security updates as soon as possible. They say Adobe-hosted instances are already remediated.

For build 9403, the notes say the Adobe Campaign server, nlserver, must be restarted to load the build and complete deployment. The fix is active by default after that restart. The notes give no separate installation steps for build 9420, the newer build.

Adobe says it is not aware of any exploits in the wild for any of the issues addressed in the update. That statement appears in the bulletin, which is dated Oct. 27, 2026, and The Hacker News report repeats it.

The bulletin names eight critical flaws, but it does not say what customer data they could reach.

Adobe Connect’s Separate Bulletin

Adobe’s Connect bulletin, APSB26-182, is dated Oct. 27, 2026 and carries priority 2. It covers CVE-2026-48360, rated critical at CVSS 9.6. The flaw is classed as code injection (CWE-94) with an impact of arbitrary code execution. The bulletin’s vector requires user interaction.

The Hacker News report describes the flaw as affecting Connect Desktop and Connect Mobile on Windows, macOS and Android. Adobe lists the affected Connect Desktop builds as 2026.8.51 and below on Windows, 2026.08.45 and below on Mac Silicon, and 2026.01.39 and below on Mac Intel. Connect Mobile on Android is affected at 4.4 and earlier.

The fixed versions are 2026.9.61 on Windows, 2026.10.66 on Mac Silicon, 2026.10.170 on Mac Intel and 4.5 on Android. Adobe recommends updating to the latest version, with downloads from the Adobe Connect Download Center and release notes linked for Windows, Mac and Android. The Hacker News report lists the same fixed versions.

Where the Sources Differ on Build Numbers

The bulletin tells users to update to the newest version but names build 9403 as the fixed version. The release notes it links to list release 7.4.5, build 9420, as the latest release, marked General Availability and dated Oct. 15, 2026.

Build 9420’s listed fixes address an analytics external account failing with a 410 error, deliveries stuck in personalization pending despite successful sends, high server CPU use, data model updates that could fail intermittently, false spam-check errors when creating or editing deliveries, and recipients not quarantined after recurring soft bounces. The notes list no security fixes for build 9420.

The Hacker News report, published Oct. 28, 2026, matches the Campaign Classic bulletin on CVE numbers, CVSS scores and the fixed build. Teams that run Campaign Classic therefore have two build numbers to check: the fixed build named in the bulletin and the latest build named in the release notes.