Vulnerabilities · 8h ago
Adobe patched nine critical flaws across Campaign Classic and Connect, including eight in Campaign Classic, and says none are known to be exploited in the wild.
In Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux, code injection and incorrect authorization flaws could allow arbitrary code execution; structured query language (SQL) injection flaws could bypass security features, and a reflected cross-site scripting flaw could enable privilege escalation. Connect’s separate code-injection flaw could also lead to code execution on affected clients. The fixes are Campaign Classic 7.4.4 build 9403, Connect Desktop 2026.9.61 for Windows and 2026.10.66 or 2026.10.170 for Mac, and Connect Mobile 4.5 for Android.
For organizations running both products, the fixes sit in separate release tracks: a current Campaign Classic server does not establish that Connect clients are current, or vice versa. Adobe reports no known exploitation, so the advisory identifies patch exposure, not evidence of an active campaign.
CVEs in this update
9 CVEs
Across Adobe Campaign Classic, Adobe Connect Desktop App, Adobe Connect Android Mobile App.
9 critical · 0 high · 0 medium · 0 low
0 in CISA KEV · 1 with EPSS above 1%
Highest severity: CVE-2026-105781 · 10.0 CRITICAL
Highest EPSS: CVE-2026-104353 · 1.3%
1 source covering this story
Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass
Adobe patches eight Campaign Classic flaws and a Connect code injection bug that could enable arbitrary code execution.
Part of the PlainSec briefing for 2026-10-28