// AI threat desk · 28 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalPATCHCVSS 9.9 / 9.8 / 9.6 / 9.3 / 9.1

Adobe patches Campaign Classic flaws that could enable code execution

Adobe patched critical Campaign Classic vulnerabilities that could enable code execution, security feature bypass and privilege escalation, plus a critical Connect code-injection flaw.

· 2 min read
AI-generated image of a security engineer reviewing blurred code and application screens at a workstation.
AI-generated image, not a photo of the event.
Key takeaways
  • Adobe said Campaign Classic flaws could enable arbitrary code execution, security feature bypass or privilege escalation.
  • The Hacker News said Campaign Classic versions 7.4.4 build 9402 and earlier are affected on Windows and Linux.
  • Adobe also resolved a critical Connect Desktop and Mobile code-injection flaw that could result in arbitrary code execution.

Adobe released patches for critical vulnerabilities in Campaign Classic and a critical code-injection flaw in Adobe Connect Desktop and Mobile. The Campaign Classic issues could enable arbitrary code execution, security feature bypass and privilege escalation, while the Connect flaw could result in arbitrary code execution.

The Campaign Classic issues affect Windows and Linux versions 7.4.4 build 9402 and earlier, according to The Hacker News. Adobe said it was not aware of any exploits in the wild for the issues addressed in the update.

The affected products are Adobe Campaign Classic and Adobe Connect Desktop and Mobile. Adobe’s update covers Campaign Classic vulnerabilities and a Connect code-injection flaw.

On this page

Campaign Classic flaws include code-execution paths

The Hacker News said CVE-2026-104351 is a code-injection vulnerability with a CVSS score of 9.9 that could lead to arbitrary code execution. It described CVE-2026-104353 as an operating system code-injection vulnerability with the same score and outcome.

It said CVE-2026-105780 is an incorrect authorization vulnerability with a CVSS score of 9.9 that could lead to arbitrary code execution. It also listed CVE-2026-105489 as an SQL injection vulnerability with a CVSS score of 9.9 that could lead to security feature bypass.

The remaining issues include CVE-2026-105781, an SQL injection vulnerability with a CVSS score of 9.8 that could lead to security feature bypass; CVE-2026-104350, a reflected cross-site scripting vulnerability with a CVSS score of 9.3 that could lead to privilege escalation; and CVE-2026-104354 and CVE-2026-105779, SQL injection vulnerabilities with CVSS scores of 9.1 that could lead to security feature bypass.

Adobe fixed Connect across four platforms

Adobe also resolved CVE-2026-48360, a critical code-injection flaw in Connect Desktop and Mobile for Windows, macOS and Android. Adobe said the vulnerability could result in arbitrary code execution.

The Hacker News listed separate fixed versions for Windows, macOS Silicon, macOS Intel and Android.

Adobe advised users to update to the latest version for optimal protection. The Hacker News said Campaign Classic was patched in version 7.4.4 build 9403, while Connect has separate fixed versions for Windows, macOS and Android.

Product and platformFixed version
Adobe Connect Desktop for Windows2026.9.61
Adobe Connect Desktop for macOS Silicon2026.10.66
Adobe Connect Desktop for macOS Intel2026.10.170
Adobe Connect Mobile for Android4.5

What to do now

  1. Update to the latest version for optimal protection.

FAQ

What Adobe products have critical vulnerabilities in this update?

Adobe patched critical vulnerabilities in Campaign Classic and a critical code-injection flaw in Connect Desktop and Mobile.

Which Adobe Campaign Classic versions are affected?

The Hacker News said Campaign Classic versions 7.4.4 build 9402 and earlier are affected on Windows and Linux.

What could the Adobe Campaign Classic flaws allow?

Adobe said the flaws could enable arbitrary code execution, security feature bypass and privilege escalation. The Hacker News described individual flaws with those potential outcomes.

Have these Adobe vulnerabilities been exploited?

Adobe said it was not aware of any exploits in the wild for any of the issues addressed in the update.

How are the Adobe flaws fixed?

Adobe advised users to update to the latest version. The Hacker News said Campaign Classic is fixed in version 7.4.4 build 9403 and listed separate fixed Connect versions for each platform.

What is CVE-2026-48360?

Adobe identified CVE-2026-48360 as a critical code-injection flaw in Connect Desktop and Mobile for Windows, macOS and Android that could result in arbitrary code execution.

Sources

  1. Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass, The Hacker News
How we checked this story
ClaimSourceStatus
Adobe released patches addressing multiple critical Campaign Classic vulnerabilities that could enable arbitrary code execution, security feature bypass, and privilege escalation.Adobe, via The Hacker NewsAttributed
The Hacker News said cVE-2026-104351 is a code injection vulnerability with a CVSS score of 9.9 that could lead to arbitrary code execution.The Hacker NewsAttributed
The Hacker News said cVE-2026-104353 is an operating system code injection vulnerability with a CVSS score of 9.9 that could lead to arbitrary code execution.The Hacker NewsAttributed
The Hacker News said cVE-2026-105780 is an incorrect authorization vulnerability with a CVSS score of 9.9 that could lead to arbitrary code execution.The Hacker NewsAttributed
The Hacker News said cVE-2026-105489 is an SQL injection vulnerability with a CVSS score of 9.9 that could lead to security feature bypass.The Hacker NewsAttributed
The Hacker News said cVE-2026-105781 is an SQL injection vulnerability with a CVSS score of 9.8 that could lead to security feature bypass.The Hacker NewsAttributed
The Hacker News said cVE-2026-104350 is a reflected cross-site scripting vulnerability with a CVSS score of 9.3 that could lead to privilege escalation.The Hacker NewsAttributed
The Hacker News said cVE-2026-104354 is an SQL injection vulnerability with a CVSS score of 9.1 that could lead to security feature bypass.The Hacker NewsAttributed
The Hacker News said cVE-2026-105779 is an SQL injection vulnerability with a CVSS score of 9.1 that could lead to security feature bypass.The Hacker NewsAttributed
The Hacker News said the Campaign Classic issues affect Windows and Linux versions 7.4.4 build 9402 and earlier.The Hacker NewsAttributed
The Hacker News said adobe patched the Campaign Classic issues in version 7.4.4 build 9403.The Hacker NewsAttributed
Adobe also resolved a critical Connect Desktop and Mobile code injection flaw with a CVSS score of 9.6 that could result in arbitrary code execution.Adobe, via The Hacker NewsAttributed
The Hacker News said adobe fixed the Connect flaw in Windows Desktop version 2026.9.61, macOS Silicon version 2026.10.66, macOS Intel version 2026.10.170, and Android version 4.5.The Hacker NewsAttributed
Adobe said it was not aware of any exploits in the wild for the issues addressed in the update.Adobe, via The Hacker NewsAttributed

Could not verify

  • How many Adobe customers or installations are affected is not established.
  • Whether the vulnerabilities are related to one another is not established.
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok