External risk intelligence

Adobe Campaign Classic SQL Injection Leads to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-82009

Adobe Campaign Classic is an enterprise marketing automation platform. While these systems often interact with web channels and APIs, they are typically deployed within internal corporate networks or controlled environments rather than being directly exposed to the public internet by design, though some modules may be internet-reachable in specific, customer-managed configurations.

SQL Injection

Adobe Campaign

7.4.3 and earlier7.4.4

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An SQL injection vulnerability in Adobe Campaign Classic could allow a highly privileged attacker to execute arbitrary commands, potentially leading to broader system compromise. The issue does not require user interaction and changes the scope of impact.

An SQL injection flaw affects Adobe Campaign Classic.
It allows high-privilege attackers to run commands.
Confirm relevance and exposure for your business.

Attack Path

How an attacker could exploit the issue

An attacker with elevated privileges could leverage a flaw in Adobe Campaign Classic to directly execute malicious SQL commands. This vulnerability allows an attacker to bypass security measures and potentially gain control over the system, leading to the execution of arbitrary code.

Requires high-privilege access.
SQL injection vulnerability.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker with high privileges could exploit this vulnerability to execute arbitrary SQL commands, potentially leading to arbitrary code execution within the context of the current user. This scenario does not require user interaction.

System data and user data may be affected.
Attacker executes SQL commands via network.
Arbitrary code execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world remediation for this SQL injection vulnerability in Adobe Campaign Classic likely falls to the platform or application owner teams, with support from infrastructure and network/security teams for exposure and access controls. The first critical step is to identify all instances of Adobe Campaign Classic, confirm their reachability and business criticality, and then engage the accountable owners to plan remediation, prioritizing based on risk and potential impact.

Platform or application owners should manage this.
Verify all Adobe Campaign Classic instances.
Plan coordinated, risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Adobe Campaign Classic?

Adobe Campaign Classic is an enterprise-grade platform used by organizations for cross-channel marketing automation. It manages complex customer data, campaign workflows, and personalized communication across email, web, and mobile channels. It is designed to integrate deeply with internal business databases to execute data-driven marketing strategies.

How does this SQL injection work in CVE-2026-82009?

This vulnerability involves a weakness known as CWE-89, or Improper Neutralization of Special Elements used in an SQL Command. Essentially, the software fails to properly filter input, allowing an attacker to inject malicious SQL queries. Because the application processes these commands, an attacker can manipulate the database and potentially execute arbitrary code on the underlying system.

Do I need high privileges to trigger this vulnerability?

Yes, exploiting this specific flaw requires elevated, high-level administrative access to the platform. It cannot be triggered by a standard user or an unauthenticated guest. Additionally, the attack does not require any interaction from other users to succeed once the attacker has established the necessary command level.

Is my Adobe Campaign Classic instance at risk?

Halo Surface Signal indicates that while these platforms are typically deployed within secure, internal corporate networks, specific customer-managed configurations may make some modules reachable via the internet. If your instance is exposed to external network traffic, it is at higher risk compared to one restricted to internal access only.

What should I do first to address this CVE?

Your first step is to perform an internal audit to inventory all instances of Adobe Campaign Classic within your environment. Once identified, evaluate the network accessibility and business criticality of each instance. Coordinate with the platform owners and security teams to prioritize these systems for remediation based on their specific risk profile and exposure.

References

helpx.adobe.com/security/products/campaign/apsb26-142.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.