CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Adobe Campaign Classic (APSB26-162), fixed in build 9403

cve · CVE-2026-105780 single-source

Coverage
1
first 2026-10-02 → last 2026-11-01
Latest activity
2026-11-01
Adobe Campaign Classic build 9402 is now affected: APSB26-162 adds a pre-auth CVSS 9.8 SQL injection; update…
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
4
3 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-105780, newest first. Check the date before acting on an older one.

  • Update every on-premise Adobe Campaign Classic v7 server, and the on-premise components of any hybrid deployment, to build 9403; build 9402 is affected by APSB26-162, including a SQL injection that needs no privileges, build 9401 fixes only APSB26-134's three flaws, and an Adobe-hosted instance that still reports 9401 is not evidence of exposure.
    2026-10-02CVE-2026-82004 +20

Defender insights

What each entry about CVE-2026-105780 tells a defender to do, newest first.

2026-10-02NOTABLEAdobe Campaign Classic build 9402 is now affected: APSB26-162 adds a pre-auth CVSS 9.8 SQL injection; update to 9403

Exposure · detection

Story timeline

  1. 2026-10-02Adobe Campaign Classic: eight unauthenticated CVSS 10.0 flaws in APSB26-142 and three more in APSB26-134, with build 9403 as the fix after APSB26-162
    trending-vulnerabilitiesAdobe Campaign Classic build 9402 is now affected: APSB26-162 adds a pre-auth CVSS 9.8 SQL injection; update to 9403

Hunting pivots

Affected products
Adobe Campaign Classic
Tags
patch-availablepre-authrcevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-02/adobe-campaign-classic-apsb26-142-134-unauth-cvss10 · ATT&CK page ↗

Entries about Adobe Campaign Classic (APSB26-162), fixed in build 9403 (1)

2026-10-02 · view entry permalink →

NOTABLECVE-2026-82004 +20updatedNATOA2

Adobe Campaign Classic: eight unauthenticated CVSS 10.0 flaws in APSB26-142 and three more in APSB26-134, with build 9403 as the fix after APSB26-162

Adobe's Priority 1 bulletin APSB26-142 covers Adobe Campaign Classic v7 7.4.4 build 9401 and earlier on Windows and Linux and names build 9402 as the fix; it was published on 2026-09-08 with one CVE and revised on 2026-09-22 to add seventeen more, for eighteen, all rated Critical (Adobe PSIRT, 2026-09-22). Ten of the eighteen need no privileges: eight are CVSS 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (CVE-2026-82004, an OS command injection; six code-injection flaws, CVE-2026-73369, -84412, -89275, -75699, -75703 and -75721; and CVE-2026-75723, an incorrect-authorization flaw), plus CVE-2026-83660 (SSRF, 9.9) and CVE-2026-75728 (incorrect authorization, 9.1) (Adobe PSIRT, 2026-09-22). The remaining eight require low or high privileges. The earlier bulletin APSB26-134 (Priority 1, 2026-08-25) fixed three more unauthenticated CVSS 10.0 flaws in build 9401, CVE-2026-76197 and CVE-2026-76195 (OS command injection) and CVE-2026-76193 (SSRF) (Adobe PSIRT, 2026-08-25).

Adobe states it is not aware of exploitation of any issue in APSB26-142, and none of these CVEs is in CISA's KEV catalog as of the 2026-10-01 version (Adobe PSIRT, 2026-09-22; CISA KEV, 2026-10-01). The bulletin applies to fully on-premise deployments and the on-premise components of hybrid deployments; Adobe-hosted instances are already remediated, and because the hosted fixes did not increment the customer-visible build number, some hosted instances still report build 9401 (Adobe PSIRT, 2026-09-22). Adobe's table names build 9402 for all eighteen; estates that stopped at build 9401 or earlier carry the ten unauthenticated flaws, and build 9402 itself is affected by APSB26-162, fixed in build 9403 (Adobe PSIRT, 2026-10-27).

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Adobe-hosted instances have already been remediated and require no customer action.

some Adobe-hosted instances may continue to report build 9401 even though the applicable security fixes have already been deployed

Adobe PSIRT (APSB26-142) 2026-09-22
Updaterun 2026-11-01T1312Z-auditactionsbodycvesheadlinesourcessummarytitle

Adobe's Priority 2 bulletin APSB26-162 of 2026-10-27 covers Campaign Classic v7 7.4.4 build 9402 and earlier on Windows and Linux and names build 9403 as the fix, so build 9402, the earlier fix, is affected (Adobe PSIRT, 2026-10-27). Its eight flaws are all rated Critical. One needs neither privileges nor user interaction: CVE-2026-105781, a SQL injection at CVSS 3.1 9.8. Four need low privileges at 9.9 (code injection CVE-2026-104351, OS command injection CVE-2026-104353, incorrect authorization CVE-2026-105780 and SQL injection CVE-2026-105489), CVE-2026-104350 is a reflected cross-site scripting flaw at 9.3 that needs user interaction, and CVE-2026-104354 and CVE-2026-105779 are SQL injections at 9.1 (Adobe PSIRT, 2026-10-27). Adobe is not aware of exploits in the wild for any of them (Adobe PSIRT, 2026-10-27). The update target for on-premise servers and the on-premise tier of hybrid deployments is now build 9403.

Builds on: Adobe ships a priority-1 fix for a CVSS 10.0 unauthenticated code-execution flaw in Campaign… · Adobe ships a second Campaign Classic emergency fix in five days; build 9398 was the patch, and… · Adobe's August bulletins carry three separate unauthenticated, maximum-severity code-execution…

vulnerability02 Oct 05:00Zsingle-sourceOpen finding →
Sources: Adobe PSIRT (APSB26-142) · Adobe PSIRT (APSB26-134) · Adobe PSIRT (APSB26-162) · CISA Known Exploited Vulnerabilities catalog · CISA Known Exploited Vulnerabilities catalog (catalog 2026.10.30)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • adobe.com2 (50%)
  • cisa.gov1 (25%)
  • helpx.adobe.com1 (25%)

External references

NVD · cve.org · CISA KEV

All cited sources (4)