EN PT-BR
← Voltar ao feed
high

Adobe patches eight critical Campaign Classic flaws (CVSS up to 9.9) and Connect code injection bug; no exploitation known

1 fonte(s) · 1 atualização(ões) · publicado 28/10/2026 08:15 · coletado há 4 dias

Adobe released security updates for Adobe Campaign Classic fixing eight critical vulnerabilities that could allow arbitrary code execution, security feature bypass and privilege escalation. Four flaws are rated CVSS 9.9 or 9.8, including code injection, OS code injection, incorrect authorization and SQL injection issues. Adobe also fixed a critical code injection flaw in Adobe Connect Desktop and Mobile (CVE-2026-48360, CVSS 9.6). Adobe stated it is not aware of any exploits in the wild for any of the issues.

Entenda a falha

A vulnerabilidade

Adobe fixed eight critical flaws in Adobe Campaign Classic 7.4.4 build 9402 and earlier (Windows and Linux). The most severe, at CVSS 9.9, are CVE-2026-104351 (code injection), CVE-2026-104353 (OS code injection) and CVE-2026-105780 (incorrect authorization), all leading to arbitrary code execution, plus CVE-2026-105489 (SQL injection, security feature bypass). CVE-2026-105781 (9.8), CVE-2026-104354 and CVE-2026-105779 (both 9.1) are also SQL injection with security feature bypass. CVE-2026-104350 (9.3) is reflected XSS leading to privilege escalation. Separately, CVE-2026-48360 (9.6) is a code injection in Adobe Connect Desktop (Windows, macOS) and Mobile (Android) leading to code execution. The articles do not give the attacker prerequisites. Fixes: Campaign Classic 7.4.4 build 9403; Connect Desktop Windows 2026.9.61, macOS Silicon 2026.10.66, macOS Intel 2026.10.170; Connect Mobile for Android 4.5.

Como funciona

The articles do not describe the internal flow of any of these flaws, so only the general class of each can be stated. In the injection cases, input handled by Campaign Classic (or Connect) is interpreted as code, an operating system command or a database query instead of being treated as plain data, which leads to code execution or to bypassing a security feature. In the incorrect authorization case, an action that should be restricted ends up allowed, with code execution as the result. In the reflected XSS case, content supplied in a request is returned in a page and runs in the victim's browser session, which is how privilege escalation becomes possible. The exact entry points and steps are not public in the sources.

Por que é vulnerável

The articles only name the weakness classes: improper handling of untrusted input (code injection, OS command injection, SQL injection, reflected XSS) and a missing or wrong authorization check. They do not explain why these went unnoticed or detail what each fix changes. Adobe's update, Campaign Classic 7.4.4 build 9403 and the new Connect builds, is what removes the flaws.

Como foi descoberta

The articles do not say who found the flaws or how they were reported. They only say Adobe released the patches and that it is not aware of any exploits in the wild for any of the issues.

Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 09:15.

Detalhes técnicos

  • CVE-2026-104351 (9.9): code injection leading to arbitrary code execution.
  • CVE-2026-104353 (9.9): OS code injection leading to arbitrary code execution.
  • CVE-2026-105780 (9.9): incorrect authorization leading to arbitrary code execution.
  • CVE-2026-105489 (9.9), CVE-2026-105781 (9.8), CVE-2026-104354 (9.1), CVE-2026-105779 (9.1): SQL injection leading to security feature bypass.
  • CVE-2026-104350 (9.3): reflected cross-site scripting leading to privilege escalation.
  • CVE-2026-48360 (9.6): code injection in Adobe Connect Desktop and Mobile (Windows, macOS, Android) leading to arbitrary code execution.
  • Affected: Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux.

Remediação

  • Update Adobe Campaign Classic to version 7.4.4 build 9403.
  • Update Adobe Connect Desktop to Windows 2026.9.61, macOS Silicon 2026.10.66 or macOS Intel 2026.10.170.
  • Update Adobe Connect Mobile for Android to version 4.5.

Linha do tempo

  1. thehackernews.com ↗ · pub. 28/10/2026 08:15 · coletado 28/10 09:00 primeiro registro

    Adobe patches eight critical Campaign Classic flaws (CVSS up to 9.9) and Connect code injection bug; no exploitation known

    ler a análise desta fonte

    Adobe released security updates for Adobe Campaign Classic fixing eight critical vulnerabilities that could allow arbitrary code execution, security feature bypass and privilege escalation. Four flaws are rated CVSS 9.9 or 9.8, including code injection, OS code injection, incorrect authorization and SQL injection issues. Adobe also fixed a critical code injection flaw in Adobe Connect Desktop and Mobile (CVE-2026-48360, CVSS 9.6). Adobe stated it is not aware of any exploits in the wild for any of the issues.

    Technical Details

    • CVE-2026-104351 (9.9): code injection leading to arbitrary code execution.
    • CVE-2026-104353 (9.9): OS code injection leading to arbitrary code execution.
    • CVE-2026-105780 (9.9): incorrect authorization leading to arbitrary code execution.
    • CVE-2026-105489 (9.9), CVE-2026-105781 (9.8), CVE-2026-104354 (9.1), CVE-2026-105779 (9.1): SQL injection leading to security feature bypass.
    • CVE-2026-104350 (9.3): reflected cross-site scripting leading to privilege escalation.
    • CVE-2026-48360 (9.6): code injection in Adobe Connect Desktop and Mobile (Windows, macOS, Android) leading to arbitrary code execution.
    • Affected: Campaign Classic 7.4.4 build 9402 and earlier on Windows and Linux.

    Remediation

    • Update Adobe Campaign Classic to version 7.4.4 build 9403.
    • Update Adobe Connect Desktop to Windows 2026.9.61, macOS Silicon 2026.10.66 or macOS Intel 2026.10.170.
    • Update Adobe Connect Mobile for Android to version 4.5.