EUVD-2026-111228
GHSA-623g-4gw8-7j44
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged ACC account
-
DeliverySubmit crafted input to vulnerable parameter
-
ExploitInject unsanitized SQL command
-
ExecutionEscalate injection to arbitrary code execution
-
ImpactImpact resources beyond component (scope change)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged Adobe Campaign Classic account (CVSS PR:L), after which the attacker sends crafted input to a parameter that is used in an SQL command without proper neutralization (CWE-89); no user interaction is required (UI:N) and the vector is network-reachable (AV:N). The precise feature, endpoint, or parameter that carries the injectable input is not described in the available sources. The principal limiting factor is the need for valid low-privilege credentials; the flaw affects ACC versions through 7.4.4 build 9402, so patched/later builds are not exposed. |
| Impact | This is a genuine high-priority issue, not an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity flaw needing only low privileges and no user interaction, with a scope change and full confidentiality/integrity/availability impact - an SQL injection that the Adobe advisory states can escalate to arbitrary code execution in the current user's context. The vuln.today decision label is 'act_now', reinforcing high urgency. Signals do, however, diverge on real-world exploitation: there is no CISA KEV listing and no EPSS score in the supplied data, and no public exploit or PoC reference is present, so the 'act_now' label here reflects the severity and the vendor's own report rather than any confirmed in-the-wild activity. The one tension to verify is the PR:L requirement: 'low-privileged attacker' means some authenticated foothold is needed, which modestly limits opportunistic mass exploitation compared with a true unauthenticated RCE, yet given that Campaign Classic operator accounts are often widely provisioned, PR:L is a low bar in practice. |
| Exploit ScenarioDerived | A low-privileged but authenticated Adobe Campaign Classic user submits crafted input that is not properly neutralized before being used in an SQL command, injecting attacker-controlled SQL. Because the flaw can be leveraged to execute arbitrary code in the current user's context with a scope change, the attacker pivots from data manipulation to code execution affecting resources beyond the vulnerable component. No public exploit code is identified in the available data and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
SQL injection in Adobe Campaign Classic through 7.4.4 build 9402 lets an authenticated low-privileged attacker execute arbitrary code in the context of the current user; the CVSS 3.1 score is 9.9 with scope change and no user interaction required. The flaw is CWE-89 and is reachable over the network by an account with low privileges. No public exploit identified at time of analysis; the vuln.today priority is act_now.
RemediationAI
Adobe advisory APSB26-162 (https://www.adobe.com/trust/security/products/campaign/apsb26-162.html) is the authoritative remediation reference; apply the vendor update for Adobe Campaign Classic. The supplied data does not list an exact fixed version, but the independent assessment notes that versions later than 7.4.4 build 9402 are not exposed. No specific workaround is documented in the provided sources, so remediation depends on moving affected ACC deployments to the vendor's corrected build and using the advisory as the authoritative patch reference.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Campaign Classic is an enterprise campaign management platform, and this issue is an SQL injection (CWE-89): special elements in attacker-supplied input are not properly neutralized before being used in a SQL command. The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H vector confirms network reachability, low attack complexity, a requirement for a valid low-privileged account, no user interaction, and high confidentiality, integrity, and availability impact with scope change-so a successful attack can affect resources beyond the vulnerable component and can lead to code execution in the context of the current user. The precise ACC feature, endpoint, or parameter that carries the injectable input is not described in the available sources.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable SQL injection needing only a low-privileged account and no user interaction (PR:L, UI:N, AC:L); escalation to arbitrary code execution with a scope change yields S:C and full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe Campaign Classic, a critical marketing automation platform, contains a severe SQL injection vulnerability (CVE-2026-105489) that allows authenticated low-privileged users to execute arbitrary code. This puts sensitive customer data and campaign operations at risk, requiring immediate leadership attention to prevent potential breaches and operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to trusted sources, enforcing strong authentication, monitoring database queries for anomalous behavior, and deploying a web application firewall with SQL injection rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Exploit-DB