CVE-2026-105489 in Campaign Classic
Summary
by MITRE • 10/27/2026
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
Adobe Campaign Classic contains a critical SQL injection vulnerability classified under CWE-89, which stems from improper neutralization of special elements used in an SQL command. This flaw allows attackers to inject malicious SQL statements into application queries by manipulating input fields that are not adequately sanitized or parameterized before being processed by the backend database engine. The root cause lies in the failure to distinguish between code and data within user-supplied inputs, enabling the execution of arbitrary commands directly on the underlying database system rather than treating them as literal string values intended for comparison or filtering purposes.
The operational impact of this vulnerability is severe because it fundamentally alters the security scope from a standard privilege escalation scenario to one involving direct remote code execution in the context of the current user running the Adobe Campaign Classic service. A low-privileged attacker, who may only have basic access rights within the application interface, can leverage this flaw to bypass authentication mechanisms and execute system-level commands without requiring any interaction from legitimate users or administrators. This characteristic aligns with ATT&CK technique T1059 Command and Scripting Interpreter, as it allows for the execution of arbitrary scripts or binaries on the host operating system through the compromised application process.
Exploitation does not require user interaction, which significantly lowers the barrier to entry for attackers and increases the likelihood of successful compromise in automated attack scenarios. Once exploited, the attacker gains control over the database server's context, potentially leading to data exfiltration, modification of critical campaign configurations, or further lateral movement within the network infrastructure depending on the permissions granted to the application service account. The change in scope indicates that this is not merely a local privilege escalation but a pathway for remote code execution with elevated privileges relative to the initial access level.
To mitigate this vulnerability, immediate patching to the latest version of Adobe Campaign Classic provided by Adobe is essential as it addresses the underlying input validation logic. In environments where patching cannot be implemented immediately, network-level controls such as Web Application Firewalls should be configured to detect and block SQL injection patterns in HTTP requests targeting affected endpoints. Additionally, implementing strict parameterized queries or prepared statements within custom integrations and ensuring that database accounts operate with least-privilege principles can limit the blast radius of any successful exploitation attempt by restricting the commands that can be executed against the backend data store.