Security notice
Run Adobe Campaign Classic on your own servers? Adobe fixed eight critical flaws. Install build 9403.
On October 27, 2026, Adobe published security bulletin APSB26-162 for Adobe Campaign Classic, the marketing platform some companies run on their own servers to send email and text campaigns. Adobe rates all eight flaws it fixed Critical, with scores from 9.1 to 9.9 out of 10, and says they could allow code execution, security feature bypass or privilege escalation. Adobe says it is not aware of any exploits in the wild. The fix is build 9403 of Campaign Classic v7 version 7.4.4. Adobe says instances it hosts are already fixed and need no action, but companies that run Campaign Classic on their own servers or in a hybrid setup need to install it and restart the server. If your business or agency runs it, ask today which build you are on.
What happened
- Eight critical flaws. Adobe's bulletin lists eight: three that could allow code execution (CVE-2026-104351, CVE-2026-104353 and CVE-2026-105780, each rated 9.9), four SQL injection flaws that Adobe says could allow a security feature bypass (CVE-2026-105489 at 9.9, CVE-2026-105781 at 9.8, CVE-2026-104354 and CVE-2026-105779 at 9.1) and one reflected cross-site scripting flaw that could allow privilege escalation (CVE-2026-104350 at 9.3). (Adobe APSB26-162)
- Who can use them, per Adobe's own scores. Adobe's scoring vectors show CVE-2026-105781 needing no account, CVE-2026-104350 needing no account but a user to click or interact, and the other six needing an account: five with low privileges and one with high privileges. We have not tested any of this, and Adobe has not published details of how the flaws work. (Adobe APSB26-162)
- Affected and fixed versions. Adobe says Campaign Classic v7, version 7.4.4 build 9402 and earlier, on Windows and Linux, is affected. The fixed version is 7.4.4 build 9403. Adobe rates the update Priority 2 and recommends updating to the newest version. (Adobe APSB26-162)
- No attacks reported. Adobe says it is "not aware of any exploits in the wild for any of the issues addressed in this update." We did not find CVE numbers from this bulletin in CISA's Known Exploited Vulnerabilities catalog, in the latest version dated October 27, which we checked on October 28. (Adobe APSB26-162, CISA KEV)
- Hosted or self-run. Adobe's release notes for build 9403 say that Adobe-hosted instances have already been fixed and need no customer action, and that on-premise and hybrid customers should install the update as soon as possible. They say the Adobe Campaign server, called nlserver, must be restarted to load the new build, and that the fix is on by default once it restarts. (Adobe release notes)
- The build is older than the bulletin. Adobe's release notes list build 9403 as released on October 15, 2026, twelve days before the bulletin. If your team keeps up with builds, you may already have it. (Adobe release notes, Adobe APSB26-162)
Who should worry
- Your company runs Adobe Campaign Classic v7 on its own servers or in a hybrid setup, on build 9402 or older.
- An agency or IT provider runs Campaign Classic for you.
- You are not sure whether your Campaign Classic is hosted by Adobe or by you. Ask. Adobe says hosted instances need nothing from you. (Adobe release notes)
Campaign Classic holds customer lists and sends messages in your name, so an attacker who takes over the server could read the lists or send messages that look like yours. That is our reading of what the product does, not something Adobe has said about these flaws.
What to do now
Do these today.
- Ask the question. Send the message below to whoever runs your Campaign Classic. You need a clear answer: is it hosted by Adobe or by us, and which build is it on?
- Check the build. Adobe's release notes tell customers to check their build under Help, then About, in the Campaign client console. You want 7.4.4 build 9403 or newer. (Adobe release notes)
- Self-run and hybrid: install the update and restart. Install build 9403 or newer using Adobe's instructions, then restart nlserver, as Adobe's release notes say. Test it on a copy first if you can, because it is a server update. (Adobe APSB26-162, Adobe release notes)
- Hosted by Adobe: nothing to install. Adobe says it has already fixed hosted instances. (Adobe release notes)
- Until it is installed, limit access. Keep Campaign servers off the open internet where you can, and review who has an account, since most of these flaws need one. This is our advice. Adobe has not given a workaround.
What to send your developer, agency or host
On October 27, 2026, Adobe published bulletin APSB26-162, fixing eight critical flaws in Adobe Campaign Classic v7 build 9402 and earlier on Windows and Linux. The fix is 7.4.4 build 9403. Adobe says it is not aware of attacks, and that Adobe-hosted instances are already fixed. Please tell me today: do we run Campaign Classic ourselves or in a hybrid setup, and which build is it on? If it is below 9403, please install the update and restart nlserver as Adobe describes, and tell me when it is done. Sources: Adobe bulletin, Adobe release notes.
Common questions
Has my business been hacked?
This notice does not mean your business has been hacked. Adobe says it knows of no attacks. It means a fix is out for self-run installs, so install it. (Adobe APSB26-162)
Can EverThread tell me if I am affected?
No. EverThread checks your website from the outside, the way a browser sees it. We do not test for these flaws, and our scan cannot see whether your company runs Campaign Classic or which build it is on. Your IT team or provider can check that. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.
I do not use Adobe Campaign. Do I need to do anything?
Not for this update. If you are not sure what your email marketing runs on, ask your marketing team or agency.
Where can I follow official updates?
Adobe's bulletin APSB26-162 and the Campaign Classic release notes are the official sources.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Adobe: Security update available for Adobe Campaign Classic, APSB26-162, published October 27, 2026, checked October 28, 2026
- Adobe: Campaign Classic v7 latest release notes, last updated October 15, 2026, checked October 28, 2026
- The Hacker News: Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass, October 28, 2026
- CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 27, 2026, checked October 28, 2026