Adobe says build 9403 fixes eight critical Campaign Classic flaws, after 36 earlier records since June

Eight records, all scored critical by Adobe, one fixed build

On 27 October 2026 at 17:03 UTC, Adobe, acting as the CVE numbering authority for its own products, published eight CVE records for Adobe Campaign Classic. Every one carries a CVSS 3.1 base score assigned by Adobe, and the lowest is 9.1. The eight scores add to 77.1, a mean of 9.64 (derived). Every one names the same affected range, "7.4.4 build 9402" and earlier, and the same fixed build, "7.4.4 build 9403". Each record points to Adobe security bulletin APSB26-162 as its advisory. This briefing was built from the eight records themselves, read from CVE.org's record service between 18:40 and 18:53 UTC on 28 October 2026.

What that does not establish is the larger part of the story. The bulletin page itself was not read. Adobe's web servers answered the research request, which carried an honest research identifier, with HTTP 403 Access Denied, including for the robots.txt file, so no page on adobe.com was fetched. Anything that only the bulletin would say, such as Adobe's own priority rating, any statement about known exploitation, and the instructions for applying the update, is therefore marked as not read below. The CVE records say nothing about whether anyone is using these flaws, nothing about how Adobe or the finders learned of them, and nothing about hosted versus self run installations.

The second fact is the one a reader can check and that the headline count hides. The same CVE.org record service, searched through the National Vulnerability Database for the words "Adobe Campaign Classic", returns 36 earlier records published between 9 June and 22 September 2026 (derived), so 44 in total over 140 days (derived), and 41 of the 44 carry an Adobe score of 9.0 or higher (derived). A server that applied the previous fix build, 9402, in September is named affected by all eight of today's records. Adobe's Commerce product, a different one, was recently added to CISA's exploited list 105 days after its patch, as this site's earlier briefing set out. That is context only. Nothing read for this briefing says Campaign Classic is exploited.

The eight flaws, as Adobe's records describe them

The table lists each record in CVE number order. The class is the weakness name in the record's own title; the CVSS column is Adobe's CVSS 3.1 base score; the last column is what the record says about the attacker. In the National Vulnerability Database all eight read "Awaiting Analysis" at 18:52 UTC, so no NIST score exists yet and every figure below is Adobe's.

Reading across the vectors (derived): all eight are reachable over the network with low attack complexity, and all eight are marked scope changed, which in CVSS means the damage can cross from the vulnerable component into others. Two need no account (CVE-2026-105781 and CVE-2026-104350), five need a low privileged one and one needs high privileges. Four of the eight are SQL injection. The scores come in four values: one at 10.0, four at 9.9, one at 9.3 and two at 9.1. For six of the eight, Adobe's wording of the impact is arbitrary code execution in the context of the current user; the cross site scripting record describes script injection into a page and possible control of a victim's session, and CVE-2026-105779 describes a security feature bypass with unauthorised read and limited write access.

Zoom

What the records state, and what they leave out

Two checks on exploitation were made, and both are weak evidence in the reassuring direction. CISA's known exploited vulnerabilities file, released 27 October 2026 at 19:00 UTC with 1,760 entries, contains none of the eight CVE numbers and no entry that names Campaign (derived by searching the saved file). CISA's coordinator also attached a decision record to two of the eight, CVE-2026-105489 at 13:44 UTC and CVE-2026-104354 at 14:58 UTC on 28 October, reading exploitation none, automatable no, technical impact total. An absence from a list a day after publication is not evidence that no one is trying, and the other six have no such record at the time of reading.

Build 9402 was the fix in September, and it is affected now

Each CVE.org record names an affected range and a fixed build. Pulling every Adobe Campaign Classic record the National Vulnerability Database returned for 2026 (nothing before 9 June) and reading each one at CVE.org gives a ladder of fix builds. There are nine publication days and eight distinct fix builds named, from 9396 to 9403 (derived). The 22 September batch, 17 records, named build 9402 as the fix, as the 8 September record had, so the build that cleared 17 flaws is named affected 35 days later (derived: 22 September to 27 October).

Zoom

What the ladder supports is narrow. It shows the vendor's own records naming a new fix build roughly every few weeks, with most records scored 9.0 or higher. It does not show that any earlier flaw was exploited, that the keyword search found every Campaign Classic record, or that the bulletins carried equal weight for every customer. It also cannot show how many installations lag the current build. A buyer, though, can read the ladder as a patch cadence: nine publication dates spanning 140 days, so 17.5 days between them on average (derived: 140 divided by 8 gaps).

Where a label is doing the work of a control

"Campaign Classic" and the version scheme. The records of 9 June to 25 August 2026 that this briefing read for the ladder mostly write the version as "ACC v7: 7.4.3 build ...", with a v7 prefix. The records of 27 October write "7.4.4 build 9402" with no prefix, and so do those of 30 July, 8 September and 22 September. A reader cannot tell from the record alone whether the product's other release line, or Adobe's separate Campaign Standard, is in scope. The records say Adobe Campaign Classic and give the build strings above; they do not mention either. Adobe's own documentation, which was not read, says which builds belong to which line. Confirm the line your contract names before assuming either way.

"SQL injection" is a class, not an impact. Three of the four SQL injection records describe the impact as arbitrary code execution in the context of the current user, and the fourth as a security feature bypass with read and limited write access. The records give no mechanism that links a database flaw to code execution, so a team that ranks "SQL injection" below "remote code execution" will rank three of these wrongly. Use Adobe's impact wording, not the class name.

"Low privileged" is not defined. Five of the eight need a low privileged account. A campaign platform is normally used by many staff and often agency users, so a login is not a rare thing. That is an inference about how such platforms are run, not a statement in the records. The control that matters is the count of accounts that can sign in, not the adjective.

"Critical" is a CVSS band. It says what the score would be if the vector is right. It is not a statement that anyone is exploiting anything, and the opposite holds too: no entry in a list yet does not make a flaw safe. "Fixed in 9403" is a build number on the vendor's side. It is true for a customer only when that customer's own instance is on 9403 or later.

Technical details

The records print no indicators of compromise, no request or payload text, no log lines and no detection rule, so there is nothing of that kind to copy. What they do print is below, copied from the CVE.org record for each CVE (the record service at cveawg.mitre.org, one record per CVE number), read 28 October 2026. Defenders use the first block to compare an instance's build with the affected range, and the second to see exactly which attacker conditions Adobe scored.

"product": "Adobe Campaign Classic"
"lessThanOrEqual": "7.4.4 build 9402", "status": "affected", "version": "0", "versionType": "custom"
"status": "unaffected", "version": "7.4.4 build 9403", "versionType": "custom"

CVE-2026-104350  9.3  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVE-2026-104351  9.9  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-104353  9.9  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-104354  9.1  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2026-105489  9.9  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-105779  9.1  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
CVE-2026-105780  9.9  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-105781  10   CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The description below is Adobe's full text for the one record scored 10.0, the SQL injection that needs no account. It is a description, not a method: it names no endpoint, parameter or request.

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-105489  Exploitation: none  Automatable: no  Technical Impact: total
CVE-2026-104354  Exploitation: none  Automatable: no  Technical Impact: total

How to read your own build number, which console screen shows it, and whether the update replaces files or runs a migration are all in Adobe's bulletin and product documentation. Neither was read for this briefing, so no instruction is given here.

What to do, in order

Campaign platforms are generally used to hold recipient lists and send messages in an organisation's name. That is an inference about the product class, since the records do not describe the product, but it is the reason the account count matters. What an attacker could read or send is not something these records state.

The question the bulletin cannot answer for you

Adobe's records say what is fixed. They cannot say which build every one of your Campaign Classic servers is running tonight, or how many people hold a login to them. If you were told on 8 September that build 9402 closed the critical flaws, who is checking that your servers are on 9403 today?

Key facts