CVE-2026-82010 in Campaign Classic
Summary
by MITRE • 09/22/2026
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
Adobe Campaign Classic contains a critical security flaw classified as an Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection and mapped to CWE-89. This vulnerability arises from the application's failure to properly sanitize or validate user-supplied input before incorporating it into dynamic database queries. When specific parameters are processed by the backend logic without adequate filtering for malicious characters such as single quotes, semicolons, or comment sequences, an attacker can manipulate the structure of the SQL command being executed against the underlying database management system. This lack of robust input validation allows external data to alter the intended query logic, effectively turning a standard data retrieval operation into a vehicle for executing arbitrary commands within the context of the application's database privileges.
The operational impact of this vulnerability is severe due to its potential for remote code execution without user interaction. Because exploitation does not require any action from legitimate users, such as clicking a link or opening an attachment, the attack surface is significantly expanded and the likelihood of successful compromise increases substantially. A low-privileged attacker who gains access to the application interface can leverage this flaw to bypass authentication mechanisms, extract sensitive data including customer records and campaign configurations, modify database contents, or escalate privileges. In many enterprise environments, the database service account runs with elevated permissions that may extend beyond simple data storage, potentially allowing the execution of operating system commands if the database engine permits such features like xp_cmdshell in Microsoft SQL Server or similar capabilities in other platforms. This transforms a seemingly isolated web application vulnerability into a full system compromise scenario.
From a threat intelligence perspective, this exploitation vector aligns with ATT&CK technique T1190, which covers Exploit Public-Facing Applications, and potentially T1059 if the SQL injection leads to command execution on the host system. The change in scope mentioned indicates that previous assessments may have underestimated the severity by assuming user interaction was required or that impact was limited to data leakage rather than full code execution. This reclassification underscores the urgency of remediation as the vulnerability represents a direct path from external access to complete control over the affected infrastructure components.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. Administrators should apply the latest security patches provided by Adobe for Adobe Campaign Classic immediately, ensuring that all hotfixes related to input validation are installed. In addition to software updates, defense-in-depth measures should be implemented, including the use of parameterized queries or prepared statements in any custom code modules within the application to ensure that user inputs are treated strictly as data rather than executable code. Network-level controls such as Web Application Firewalls can also provide a layer of protection by detecting and blocking common SQL injection patterns before they reach the vulnerable component. Regular security audits and penetration testing should be conducted to identify similar weaknesses in other parts of the application, ensuring that input validation is consistently applied across all data entry points.