Is CVE-2026-104354 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104354 being exploited in the wild.

How severe is CVE-2026-104354?

Critical severity, with a CVSS score of 9.1, published 27 October 2026.

Which products and versions are affected?

Adobe Campaign Classic v7: 7.4.4 build 9402 and earlier.

Is there a fix for CVE-2026-104354?

Yes: fixed in Campaign Classic v7: 7.4.4 build 9403. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104354 attacked?

It is attacked over the network.

Am I affected by CVE-2026-104354?

Check whether you run Adobe Campaign Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104354: Adobe Campaign Classic SQL injection in security feature bypass

CVE-2026-104354 · Severity: critical · CVSS 9.1 · Published 2026-10-27

Adobe Campaign Classic is a marketing automation platform used by enterprises to manage customer communications. CVE-2026-104354 is a SQL injection flaw that allows high-privilege attackers to bypass security controls and manipulate data without user interaction. An attacker exploiting this vulnerability could gain unauthorized access to sensitive customer data or campaign information.

Technologies: Adobe Campaign Classic. Vendors: Adobe.

Quick answers

Is CVE-2026-104354 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104354 being exploited in the wild.
How severe is CVE-2026-104354?: Critical severity, with a CVSS score of 9.1, published 27 October 2026.
Which products and versions are affected?: Adobe Campaign Classic v7: 7.4.4 build 9402 and earlier.
Is there a fix for CVE-2026-104354?: Yes: fixed in Campaign Classic v7: 7.4.4 build 9403. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104354 attacked?: It is attacked over the network.
Am I affected by CVE-2026-104354?: Check whether you run Adobe Campaign Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Campaign Classic v7: 7.4.4 build 9403

Technical details

A SQL injection vulnerability (CWE-89) in Adobe Campaign Classic v7 allows attackers with high privileges to execute arbitrary SQL commands through improper sanitization of user input. The attack vector is network-based with no user interaction required; exploitation requires high-privilege access (PR:H). Successful exploitation bypasses security features and grants confidentiality, integrity, and availability impact across the system boundary.

Affected products

Adobe Campaign Classic v7: 7.4.4 build 9402 and earlier

Timeline

2026-10-27: disclosed
2026-10-27: advisory: Adobe Security Bulletin APSB26-162

References

https://www.adobe.com/trust/security/products/campaign/apsb26-162.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.