Adobe fixes nine critical flaws across Campaign Classic and Connect
Adobe patched nine critical flaws across Campaign Classic and Connect, including eight in Campaign Classic, and says none are known to be exploited in the wild.
In Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux, code injection and incorrect authorization flaws could allow arbitrary code execution; structured query language (SQL) injection flaws could bypass security features, and a reflected cross-site scripting flaw could enable privilege escalation. Connect’s separate code-injection flaw could also lead to code execution on affected clients. The fixes are Campaign Classic 7.4.4 build 9403, Connect Desktop 2026.9.61 for Windows and 2026.10.66 or 2026.10.170 for Mac, and Connect Mobile 4.5 for Android.
For organizations running both products, the fixes sit in separate release tracks: a current Campaign Classic server does not establish that Connect clients are current, or vice versa. Adobe reports no known exploitation, so the advisory identifies patch exposure, not evidence of an active campaign.
1 source · 9h ago
CVEs in this update
9 CVEs
Across Adobe Campaign Classic, Adobe Connect Desktop App, Adobe Connect Android Mobile App.