External risk intelligence

Adobe Campaign Classic SQL Injection Leads to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-105781

Adobe Campaign Classic is an enterprise marketing platform typically deployed to manage external-facing web campaigns, APIs, and customer-facing interfaces. As a web-based marketing application, it is commonly configured to be internet-accessible to support campaign delivery and data collection, making the underlying application surface frequently reachable from the public internet.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Adobe Campaign Classic is impacted by a critical SQL injection vulnerability, allowing remote attackers to execute arbitrary code and potentially gain elevated access or control. The vulnerability does not require user interaction to exploit and can change the scope of impact.

SQL injection in marketing software.
Critical flaw, impacts external-facing systems.
Confirm relevance and scope of exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target Adobe Campaign Classic by sending specially crafted SQL commands over the network. If successful, the vulnerability allows the attacker to execute arbitrary SQL commands, potentially leading to unauthorized access and control within the application's environment. This could result in the execution of arbitrary code within the context of the user.

No privileges or user interaction needed.
Attacker sends malicious SQL commands.
Arbitrary code execution and elevated access.

Live Threat

Current exploitation, exposure, and threat context

This SQL injection vulnerability in Adobe Campaign Classic could allow an unauthenticated attacker to execute arbitrary SQL commands. When supported by the advisory, this could lead to elevated access or control over the victim's account or session.

SQL commands could be executed.
Network access enables exploitation.
Could lead to elevated access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security and infrastructure teams are likely responsible for addressing this SQL injection vulnerability in Adobe Campaign Classic, as it impacts an enterprise marketing platform often exposed externally. The first step is to confirm the presence of affected instances, determine their reachability and business criticality, and then identify the accountable owner to plan remediation.

Security and infrastructure teams own the issue.
Verify instance reachability and business criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Campaign Classic?

Adobe Campaign Classic is an enterprise marketing platform used to design, automate, and manage cross-channel marketing campaigns. Organizations rely on it to handle customer data, personalize web-based communications, and orchestrate large-scale marketing workflows across email, mobile, and web channels.

What does CVE-2026-105781 mean by SQL Injection?

This vulnerability is classified as CWE-89, which occurs when software improperly processes user-supplied data before including it in a database query. In this case, an attacker can supply malicious SQL commands that the application executes as if they were legitimate, potentially granting them unauthorized control over the application's data or the ability to run arbitrary code.

How can an attacker trigger this vulnerability?

An attacker can exploit this by sending specially crafted SQL commands over the network to the affected application. Because the flaw does not require any interaction from a user or existing authentication, it can be triggered remotely. Note that this is a technical vulnerability in how the software processes input, not a result of a user clicking a link or performing a specific action.

Why should I care about this if I run Adobe Campaign Classic?

According to Halo Surface Signal, this software is typically deployed to manage public-facing web campaigns and APIs, often making it reachable from the internet. Because the vulnerability allows for remote execution without authentication, any instance exposed to the public internet is at a higher risk of being targeted by unauthorized actors.

What should I do first to manage this risk?

Begin by identifying all instances of Adobe Campaign Classic within your environment. Verify which systems are reachable from the internet versus those kept on internal networks. Once you have mapped these assets, determine their business criticality and coordinate with the infrastructure owners to ensure the latest security updates from Adobe are applied.

References

www.adobe.com/trust/security/products/campaign/apsb26-162.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.