Adobe Campaign Classic: SQL Injection remote code execution (CVE-2026-105781)

Adobe Campaign Classic is affected by an SQL injection vulnerability (CVE-2026-105781) that permits an unauthenticated remote attacker to achieve arbitrary code execution in the context of the application user. This vulnerability carries a CVSS score of 10.0 and does not require user interaction. A proof-of-concept exploit is publicly available, increasing the risk of exploitation.

Impact

The vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands and achieve arbitrary code execution. This could lead to full system compromise, data exfiltration, or complete loss of availability for the Campaign Classic environment.

Recommendation

1. Inventory all Adobe Campaign Classic instances within the environment.
2. Apply the vendor-provided security updates documented in APSB26-162 immediately.
3. Restrict network access to the Campaign Classic administrative and API interfaces to known, trusted management segments until patching is complete.