Cpe:2.3:a:adobe:campaign_classic:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aadobecampaign_classic/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 20:23:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAdobe Campaign Classic: SQL Injection remote code execution (CVE-2026-105781)https://feed.craftedsignal.io/briefs/2026-10-adobe-campaign-classic-sql-injection/Tue, 27 Oct 2026 20:23:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-adobe-campaign-classic-sql-injection/Adobe Campaign Classic is vulnerable to an unauthenticated SQL injection flaw (CVE-2026-105781) that allows for remote code execution, with public exploit code now available.Adobe Campaign Classic is affected by an SQL injection vulnerability (CVE-2026-105781) that permits an unauthenticated remote attacker to achieve arbitrary code execution in the context of the application user. This vulnerability carries a CVSS score of 10.0 and does not require user interaction. A proof-of-concept exploit is publicly available, increasing the risk of exploitation.

Impact

The vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands and achieve arbitrary code execution. This could lead to full system compromise, data exfiltration, or complete loss of availability for the Campaign Classic environment.

Recommendation

  1. Inventory all Adobe Campaign Classic instances within the environment.
  2. Apply the vendor-provided security updates documented in APSB26-162 immediately.
  3. Restrict network access to the Campaign Classic administrative and API interfaces to known, trusted management segments until patching is complete.
]]>criticaladvisorysql-injectionrcevulnerability