Zero Radar
← feed
CriticalVulnerabilityCVE-2026-105779updated 27 Oct 2026, 20:35 UTC

Adobe Campaign Classic: SQL injection lets low-privilege users bypass security

A flaw in Adobe Campaign Classic lets someone with a basic account reach data they should not see, and change some of it. No user clicks are needed for an attack.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Low-privilege attackerHas a basic ACC user account
  2. 2Crafted inputMalicious SQL injected into a request
  3. 3Database queryApplication runs the altered SQL command
  4. 4Unauthorized accessReads data and limited writes beyond permissions
  5. ResultAttacker reads and alters data without permission

What happened

Adobe Campaign Classic (ACC) has an SQL injection vulnerability (improper neutralization of special elements in an SQL command) that allows a low-privileged attacker to bypass security features, gaining unauthorized read access and limited write access; the scope is changed.

Why it is dangerous: An attacker with only a low-privilege account could read data they should not access and make limited changes, potentially affecting the wider system. Organizations running ACC that allow many internal or external user accounts are most exposed.

Are you affected?

You are affected if you run Adobe Campaign Classic (ACC) in a version covered by the advisory.

Adobe Campaign Classic (ACC) - specific versions not stated in the provided material.

What to do

  1. Check Adobe's security bulletin for ACC and identify the patched version for your release
  2. Apply the vendor update to all ACC instances as soon as possible
  3. Restrict low-privilege account creation and review existing accounts until patched

Timeline

  1. 27 Oct 2026, 17:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 17:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 17:20 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 20:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-105779 · GHSA-8rvh-6w2p-xpwx
CVSS
9.1 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 17:16 UTC
On Zero Radar
27 Oct 2026, 17:20 UTC (4 min after disclosure)
Last change
27 Oct 2026, 20:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Adobe Campaign Classic: SQL injection lets low-privilege users bypass security · Zero Radar