External risk intelligence

Adobe Campaign Classic SQL Injection Leading to Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-105489

Adobe Campaign Classic is an enterprise marketing automation platform designed to manage and deliver public-facing campaigns, web forms, and email services. These systems are typically deployed with web-accessible interfaces or API endpoints to facilitate interaction with external marketing data and campaign responses, making them commonly reachable from the internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Adobe Campaign Classic is impacted by a critical vulnerability that could allow unauthorized code execution. This issue affects how the platform handles specific commands, potentially enabling a low-privilege attacker to run their own code within the system. While the specific business impact is not detailed, the nature of this vulnerability warrants attention to confirm its relevance to our environment.

A critical flaw allows unauthorized code execution.
This impacts enterprise marketing automation systems.
Confirm relevance and exposure to our environment.

Attack Path

How an attacker could exploit the issue

An attacker with low-level access could exploit this vulnerability in Adobe Campaign Classic by sending specially crafted input to a feature that processes SQL commands. This could allow them to run their own code on the system.

Entry condition: Low-privileged access.
Trigger point: SQL command processing.
Resulting risk: Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

An SQL Injection vulnerability in Adobe Campaign Classic could allow a low-privileged attacker to execute arbitrary code. This could occur when supported input validation is not performed on SQL commands, potentially impacting system integrity and data confidentiality.

System code and data could be at risk.
Exposure could happen via crafted SQL commands.
Arbitrary code execution may result.

Operational Fix

Recommended remediation, mitigation, and detection steps

The responsibility for addressing this SQL injection vulnerability in Adobe Campaign Classic likely falls to the platform or application owner, with support from the security and network teams. The first practical step involves identifying all instances of Adobe Campaign Classic within the environment, assessing their exposure and business criticality, and then confirming the accountable owner to initiate a coordinated remediation plan.

Platform or application owners
Verify product reachability and criticality.
Plan and coordinate risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Campaign Classic?

Adobe Campaign Classic is an enterprise-grade marketing automation platform. Organizations use it to manage customer data, orchestrate multi-channel campaigns, and deliver personalized email services and web forms. Because it often handles public-facing marketing interactions, it frequently functions as a bridge between internal databases and external user traffic.

What does CVE-2026-105489 mean by SQL Injection?

This vulnerability, classified as CWE-89, occurs when the software fails to properly neutralize special characters in user-supplied input before including it in a database query. In this specific instance, an attacker can manipulate these SQL commands to bypass security controls, ultimately allowing them to execute arbitrary code within the system's environment.

How can an attacker trigger this vulnerability?

An attacker triggers this by submitting specially crafted input to specific features within the platform that process SQL commands. The vulnerability does not require the attacker to have administrative rights, as low-privileged access is sufficient. It is important to note that user interaction is not required to trigger the flaw; the system processes the malicious input automatically once it is sent.

Is my Adobe Campaign Classic instance at risk?

According to Halo Surface Signal, this software is often deployed with web-accessible interfaces or APIs to support marketing campaigns, making instances frequently reachable from the internet. If your deployment is exposed to the network to handle public-facing data or external requests, it is more likely to be reachable by an attacker compared to a system restricted to an internal-only network.

What should I do if I use Adobe Campaign Classic?

The first step is to create an inventory of all Adobe Campaign Classic instances running in your environment. Once identified, work with the application owners to assess the business criticality of each instance and confirm its network accessibility. Coordinating with your security team will help you prioritize these systems for formal remediation as guided by official vendor documentation.

References

www.adobe.com/trust/security/products/campaign/apsb26-162.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.