Adobe has released security updates to fix nine critical vulnerabilities across Adobe Campaign Classic and Adobe Connect, including flaws that could allow attackers to execute arbitrary code, bypass security protections and escalate privileges.
The company disclosed the issues in two security bulletins published on October 27, 2026, urging customers to update affected installations. Adobe said it is not aware of any active exploitation of the vulnerabilities addressed in either update.
Eight of the vulnerabilities affect Adobe Campaign Classic, a platform businesses use to manage marketing campaigns and customer communications. The flaws affect version 7.4.4 build 9402 and earlier on Windows and Linux systems. Adobe has addressed them in version 7.4.4 build 9403.
The most severe issues carry CVSS scores of 9.9 out of 10. CVE-2026-104351 is a code-injection vulnerability, while CVE-2026-104353 involves operating system command injection. Both could allow arbitrary code execution. CVE-2026-105780, an authorization flaw, could also lead to code execution under certain conditions.
The remaining Campaign Classic vulnerabilities include four SQL injection flaws and a reflected cross-site scripting issue. CVE-2026-105489 carries a CVSS score of 9.9, while CVE-2026-105781 is rated 9.8. CVE-2026-104354 and CVE-2026-105779 have scores of 9.1, and CVE-2026-104350 is rated 9.3. Depending on the flaw, successful exploitation could allow attackers to bypass security controls or escalate privileges. Some of these vulnerabilities require authentication, while others can be exploited without it.
Adobe has also fixed a critical code-injection vulnerability in Adobe Connect, tracked as CVE-2026-48360 and rated 9.6 on the CVSS scale. Successful exploitation could allow arbitrary code execution in the context of the affected application. The vulnerability affects Adobe Connect Desktop on Windows and macOS, as well as Adobe Connect Mobile on Android.
Users should update Adobe Connect Desktop to version 2026.9.61 on Windows, version 2026.10.66 on Apple Silicon Macs, or version 2026.10.170 on Intel-based Macs. Android users should upgrade Adobe Connect Mobile to version 4.5.
Adobe has classified both security updates as Priority 2 and recommends installing the relevant patches. Administrators responsible for enterprise deployments should verify installed versions, schedule updates promptly and ensure that all affected systems receive the appropriate fixes.
Although Adobe has not reported active exploitation of these flaws, the high severity ratings make patching important, particularly for systems accessible over networks. Keeping enterprise applications updated reduces the risk that attackers could exploit weaknesses to execute code, bypass security protections or gain unauthorized access.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
