As reported by The Hacker News, Adobe has patched eight critical vulnerabilities in Campaign Classic, including three rated at CVSS 9.9, alongside a separate 9.6-rated code injection flaw in Adobe Connect. The absence of active exploitation is meaningful but temporary — these are precisely the kind of high-severity, network-accessible flaws that become prime targets once patches are publicly available.
Why Campaign Classic Demands Immediate Attention
Adobe Campaign Classic is enterprise marketing automation software, which means it routinely processes large volumes of personally identifiable information (PII), customer segmentation data, and integrates with CRM platforms. It often runs on internal infrastructure with broad network access and, critically, frequently operates with elevated database permissions for campaign execution workflows. A successful code injection or SQL injection in this context is not merely a web vulnerability problem — it is a potential pivot point into customer data lakes and downstream systems.
The vulnerability profile here is particularly concerning because it spans multiple weakness classes simultaneously:
This combination suggests a systemic code quality issue across the platform rather than isolated bugs, which raises questions about whether additional unpatched flaws may exist in adjacent components.
Who Is Most Exposed
The most exposed organizations are enterprises running Adobe Campaign Classic v7.4.4 build 9402 or earlier on Windows or Linux — particularly those with:
- Internet-facing Campaign Classic deployments accessible without VPN
- Shared service accounts with excessive database privileges
- Marketing operations teams with broad administrative access to the platform
- Integration pipelines connecting Campaign Classic to Salesforce, Microsoft Dynamics, or other CRM systems that could serve as lateral movement targets
Organizations in retail, financial services, and healthcare — sectors that heavily rely on Campaign Classic for customer engagement — should treat this as a highest-priority patch cycle.
Shield53 Recommendations
Immediate Actions
- Patch now: Upgrade to Adobe Campaign Classic v7.4.4 build 9403 immediately. Do not delay for maintenance windows given the severity ratings.
- Isolate exposure: If patching cannot be completed within 48 hours, restrict external access to Campaign Classic instances via network-level controls (WAF rules, IP allowlisting, VPN-only access).
- Audit access logs: Review authentication logs for anomalous session activity, unusual API calls, or unexpected administrative actions dating back at least 30 days.
- Review database permissions: Ensure the service account used by Campaign Classic follows least-privilege principles. The SQL injection vulnerabilities mean database-level controls are your last line of defense.
- Deploy detection content: Create rules monitoring for unexpected operating system command execution originating from Campaign Classic processes, unusual SQL queries from the application's database connection, and privilege escalation events within the platform's audit logs.
Strategic Considerations
Beyond patching, this disclosure reinforces a broader pattern: marketing and customer engagement platforms are under-recognized as critical security infrastructure. They handle sensitive data, integrate broadly, and are often administered by teams outside the traditional security operations perimeter. Organizations should map all such platforms — marketing automation, customer data platforms, engagement analytics — into their asset inventory and vulnerability management programs with the same rigor applied to core business systems.
The Adobe Connect vulnerability (CVE-2026-48360) should not be overlooked either. Desktop collaboration tools represent a growing attack surface, and a 9.6-rated code injection flaw in meeting software that runs on employee endpoints warrants same-cycle patching.
