Adobe Campaign Classic CVE-2026-105781

Per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N), no user interaction is required and exploitation is network-reachable against affected Adobe Campaign Classic instances. The concrete limiting factor confirmed by the evidence is version: only Adobe Campaign Classic builds at or below 7.4.4 build 9402 are listed as affected, so patched/newer builds are out of scope. The specific injectable feature, parameter, or endpoint is not described in the available sources. One caveat for defenders: although the vector is PR:N, the description's phrasing ('context of the current user', 'victim's account or session') may imply an existing session context - confirm with Adobe whether any authenticated session is in practice required, as this materially changes exposure for internet-facing versus internal deployments.

This is a genuine top-priority issue, not a high-CVSS-but-low-real-risk case. The vendor (Adobe) assigned CVSS 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - network-reachable, low attack complexity, no privileges, no user interaction, with a changed scope and total confidentiality/integrity/availability loss. The vuln.today decision label is 'act_now', reinforcing urgency. The signals are internally consistent for maximum severity: an unauthenticated, remotely triggerable SQL injection (CWE-89) that the description says can lead to arbitrary code execution and control of the victim's account or session. Note a tension worth verifying: the CVSS vector states PR:N (unauthenticated), yet the description frames impact as 'in the context of the current user' and over 'the victim's account or session', wording that can imply an existing user/session context - this should be confirmed with Adobe, because it affects whether truly no authentication is needed. No EPSS score, no CISA KEV listing, and no POC/exploit reference are present in the supplied data, so there is no evidence of active exploitation or public exploit code; risk is driven by the intrinsic severity and vendor priority rather than observed in-the-wild activity.

A remote attacker reaches a network-exposed Adobe Campaign Classic instance and submits input containing crafted SQL that is not properly neutralized, allowing arbitrary SQL commands to run and, per the advisory, arbitrary code execution in the context of the current user. Because scope is changed, the impact can extend beyond the initially vulnerable component. No public exploit was identified at the time of analysis, and the trigger mechanism (which parameter or feature is injectable) is not described in the available sources.