Adobe's security bulletin APSB26-162, published 27 October 2026, says Adobe has released a priority 2 security update for Adobe Campaign Classic that addresses vulnerabilities rated critical that could result in arbitrary code execution, security feature bypass and privilege escalation.

The bulletin lists ACC v7 7.4.4 build 9402 and earlier on Windows and Linux as affected, and ACC v7 7.4.4 build 9403 as the updated version. All eight CVEs are rated Critical by Adobe: CVE-2026-104351 (code injection, CVSS 9.9), CVE-2026-104353 (OS command injection, 9.9) and CVE-2026-105780 (incorrect authorization, 9.9), each with arbitrary code execution as the impact; CVE-2026-105489 (SQL injection, 9.9), CVE-2026-105781 (SQL injection, 9.8, with a vector that requires no privileges), CVE-2026-104354 (SQL injection, 9.1) and CVE-2026-105779 (SQL injection, 9.1), each with security feature bypass as the impact; and CVE-2026-104350 (reflected cross-site scripting, 9.3) with privilege escalation as the impact.

Adobe says it is not aware of any exploits in the wild for any of the issues addressed in this update. The Hacker News reported the update on 28 October.