CVE-2026-104354

CriticalCVSS 9.1/10Last modified Oct 28, 2026

Description

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Adobe	Adobe Campaign Classic	<= 7.4.4 build 9402

References

https://www.adobe.com/trust/security/products/campaign/apsb26-162.html

Timeline

Published: Oct 27, 2026
Last modified: Oct 28, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1043557.0A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the recei CVE-2026-1043565.9PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand CVE-2026-1043643.3IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input val CVE-2026-1043688.8The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2 CVE-2026-1043805.3Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On H CVE-2026-1043816.0A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positio CVE-2026-1043839.4Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows a CVE-2026-1043848.7Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premi CVE-2026-1043857.5Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.CVE-2026-1043866.5Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.Thi CVE-2026-1043877.2Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.CVE-2026-1043885.3Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issu