Adobe Patches Eight Critical Campaign Classic Flaws, Four Rated CVSS 9.9
Adobe has released patches for eight critical flaws in Campaign Classic, its marketing automation platform. Four are rated CVSS 9.9, including CVE-2026-104351, a code injection flaw allowing arbitrary code execution; the batch also covers security feature bypass and privilege escalation. No active exploitation is reported; administrators should apply the updates immediately on Windows and Linux versions.
What happened
Adobe has patched eight critical flaws in Campaign Classic, its marketing automation platform. If exploited, they allow arbitrary code execution, security feature bypass, and privilege escalation. Four of the eight flaws are rated CVSS 9.9, according to The Hacker News.
Why it matters
Campaign Classic handles customer data and marketing campaigns; a compromise could expose that data and halt communications operations. Code execution and privilege escalation flaws give an attacker broad control of the affected server.
What to do
Apply Adobe's updates immediately to all Windows and Linux installations of Campaign Classic. Inventory how many instances exist in the environment and confirm every one is patched.
For the technical team
- CVE
- CVE-2026-104351
- Affected
- Adobe Campaign Classic (plataforma de automação de marketing) · Windows and Linux versions of Adobe Campaign Classic. Specific versions not cited in the sources.
- Exploitation
- No active exploitation reported by the sources.
- Fix
- Patches released by Adobe; apply the updates immediately. Fixed versions not specified in the sources.
- Vector
- Eight flaws in Adobe Campaign Classic. The most severe is CVE-2026-104351, a code injection flaw with CVSS 9.9 that could lead to arbitrary code execution. The batch includes security feature bypass and privilege escalation. The sources do not detail exploitation conditions, such as authentication requirements.
- More details
- The Hacker News reports that four of the eight flaws are rated CVSS 9.9. The sources identify only CVE-2026-104351; the remaining identifiers were not disclosed in the available texts.
Timeline
The Hacker News details that four of the eight flaws are rated CVSS 9.9 and allow arbitrary code execution, security bypass, and privilege escalation; Windows and Linux versions are affected.
Incident opened.
Sources 2 sources
- Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass The Hacker News
- @TheHackersNews @TheHackersNews
