Adobe released two security bulletins fixing nine critical vulnerabilities in Adobe Campaign Classic and Adobe Connect, including a CVSS 10.0 SQL injection flaw tracked as CVE-2026-105781. The bulletins were published on October 27.
CVE-2026-105781 and Four 9.9-Rated Flaws Lead the Bulletins
CVE-2026-105781 is the highest-rated issue, an SQL injection scored 10.0. Four more flaws score 9.9: CVE-2026-104351, a code injection; CVE-2026-104353, an OS command injection; CVE-2026-105780, an improper authorization flaw; and CVE-2026-105489, another SQL injection.
Lower-Scoring Critical Bugs in the Bulletins
Below those sit CVE-2026-48360, scored 9.6 and affecting Connect, CVE-2026-104350, a cross-site scripting flaw scored 9.3, and CVE-2026-104354, an SQL injection scored 9.1.
The advisory material lists the impacts across the set as arbitrary code execution, security feature bypass and privilege escalation. Three of the named flaws are SQL injection, which gives the bulletins a database-access theme alongside the code-execution bugs.
Fixed Versions for Both Products
Campaign Classic fixes are in 7.4.4 build 9403. Adobe Connect fixes arrive in 2026.9.61 for Windows, 2026.10.66 for Mac Silicon, 2026.10.170 for Mac Intel, and in version 4.5.
Adobe assigned the updates Priority 2. Reporting on the bulletins says no exploitation has been confirmed.
What the Affected Products Hold
Adobe Campaign Classic is a marketing platform that stores customer databases and manages outbound campaigns. Adobe Connect handles virtual meetings and webinars. The impact summary for the bulletins says that marketing databases and virtual meeting infrastructure at enterprises and governments are at risk if the updates are not applied.
Three SQL Injection Flaws, Including CVE-2026-105781
Adobe Campaign Classic sits directly on top of customer data. SQL injection is the class of flaw that can expose or alter database records, and the bulletins include three of them: CVE-2026-105781 (10.0), CVE-2026-105489 (9.9) and CVE-2026-104354 (9.1). The advisory material available does not say which product each CVE affects, apart from CVE-2026-48360, which affects Connect.
Code and Command Injection Alongside the SQL Flaws
The 9.9-rated code injection and OS command injection flaws add a route to running attacker-chosen code. The advisory does not describe the authentication requirements for each flaw in the material available, so the practical difficulty of exploiting them is not stated.
Priority 2 Rating and Absence of Exploitation
Adobe rates updates Priority 2 when a product has historically been targeted but no exploit is known for the flaws being fixed. Reporting on the bulletins says no attacks have been confirmed, so the high CVSS scores reflect what exploitation could achieve, not observed attacks.
Large batches of critical vulnerabilities in a single release cycle are often followed by researchers publishing analyses once patches are public. The bulletins’ identifiers are public from the day of release, which lets defenders and attackers alike track the affected versions.
Nine Critical Adobe Flaws Across Five Version Streams
Nine critical entries across two products shipped on a single day. The patches are available now for the five version streams listed. Organizations that run Campaign Classic builds older than 7.4.4 build 9403, or Connect releases older than the listed ones, remain exposed to the described flaws until they update.
The spread of the nine critical flaws across two products also shows where the risk concentrates. Campaign Classic fixes sit in a single build, 7.4.4 build 9403, while Connect has its own fixes across four platform-specific builds. The varied version numbers for Connect, with separate builds for Windows, Mac Silicon and Mac Intel, mean administrators must match the update to the operating system. Adobe’s bulletins describe arbitrary code execution, security feature bypass and privilege escalation as the outcomes.
Taken together, the bulletins cover flaws of several types in one release: three SQL injection bugs, a code injection, an OS command injection, an improper authorization flaw and a cross-site scripting issue. That variety means the update addresses different weaknesses in the same products rather than repeated instances of a single coding error. Adobe published the identifiers and fixed versions on the day of release, and no attacks have been confirmed against any of them.
