# CVE-2026-105781: Adobe Campaign Classic SQL injection in security feature bypass

Source: https://junglewise.ai/threats/cve-2026-105781-adobe-campaign-classic-acc-is-affected-by-an-improper  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-105781 · Severity: critical · CVSS 10 · Published 2026-10-27

Adobe Campaign Classic, a marketing and customer relationship management platform, contains a SQL injection vulnerability that allows attackers to bypass security controls and manipulate the database. An attacker with network access can exploit this flaw without authentication to execute arbitrary SQL commands, potentially leading to unauthorized data access or modification of campaign data and user accounts.

Technologies: [Adobe Campaign Classic](https://junglewise.ai/threats/technologies/campaign-classic). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-105781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105781 being exploited in the wild.

**How severe is CVE-2026-105781?** Critical severity, with a CVSS score of 10, published 27 October 2026.

**Which products and versions are affected?** Adobe Campaign Classic 7.4.4 build 9402 and earlier.

**Is there a fix for CVE-2026-105781?** Yes: fixed in Campaign Classic 7.4.4 build 9403. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105781 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105781?** Check whether you run Adobe Campaign Classic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Campaign Classic 7.4.4 build 9403

## Technical details

The vulnerability is an improper neutralization of special elements in SQL commands (CWE-89) affecting Campaign Classic. It requires network access but no prior authentication (PR:N), and does not require user interaction, enabling unauthenticated remote exploitation. A successful attack bypasses security features and grants attackers high confidentiality, integrity, and availability impact on the affected system.

## Affected products

- Adobe Campaign Classic 7.4.4 build 9402 and earlier

## Timeline

- 2026-10-27: disclosed

## References

- [https://www.adobe.com/trust/security/products/campaign/apsb26-162.html](https://www.adobe.com/trust/security/products/campaign/apsb26-162.html)

## Related threats

- [Adobe Campaign Classic authorization bypass allowing arbitrary code execution](https://junglewise.ai/threats/cve-2026-105780-adobe-campaign-classic-acc-is-affected-by-an-incorrect)
- [Adobe Campaign Classic SQL injection security feature bypass](https://junglewise.ai/threats/cve-2026-105779-adobe-campaign-classic-acc-is-affected-by-an-improper)
- [Adobe Campaign Classic SQL injection in security feature](https://junglewise.ai/threats/cve-2026-105489-adobe-campaign-classic-acc-is-affected-by-an-improper)
- [Adobe Campaign Classic SQL injection in security feature bypass](https://junglewise.ai/threats/cve-2026-104354-adobe-campaign-classic-acc-is-affected-by-an-improper)
- [Adobe Campaign Classic OS command injection](https://junglewise.ai/threats/cve-2026-104353-adobe-campaign-classic-acc-is-affected-by-an-improper)