Zero Radar
← feed
CriticalVulnerabilityCVE-2026-105781updated 27 Oct 2026, 20:35 UTC

Adobe Campaign Classic: SQL injection allows code execution

A flaw in Adobe Campaign Classic lets an attacker send specially crafted input that the software runs as database commands. This can let them take over the account or session that the software is running under, without anyone clicking anyth

Official, 2 sources
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends inputCrafted request needs no user interaction
  2. 2ACC builds SQLInput is not properly neutralized
  3. 3Database runs commandsArbitrary SQL is executed
  4. 4Code runs as userRuns in current user's context
  5. ResultAttacker gains control of the session

What happened

Adobe Campaign Classic (ACC) has an SQL injection vulnerability (CWE-89) in which unsanitized input is passed into SQL commands, enabling arbitrary SQL execution and arbitrary code execution in the context of the current user. No user interaction is required and the scope is changed.

Why it is dangerous: An attacker can gain elevated access or control over the victim's account or session, which can extend beyond the vulnerable component. Organizations running Adobe Campaign Classic and their marketing and customer data systems are at risk.

Are you affected?

You are affected if you run Adobe Campaign Classic (ACC), though the exact affected versions are not stated in the material.

What to do

  1. Check Adobe's security bulletin for ACC and identify the fixed version for your release line
  2. Update Adobe Campaign Classic to the fixed version as soon as possible
  3. Until patched, restrict network access to ACC and review logs for unusual database activity

Timeline

  1. 27 Oct 2026, 17:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 17:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 17:20 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 20:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-105781 · GHSA-r3v6-wxx2-553x
CVSS
10 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 17:16 UTC
On Zero Radar
27 Oct 2026, 17:20 UTC (4 min after disclosure)
Last change
27 Oct 2026, 20:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Adobe Campaign Classic: SQL injection allows code execution · Zero Radar