Adobe has shipped a security update for its Campaign Classic marketing automation platform, closing eight critical vulnerabilities that could expose organizations to arbitrary code execution, security feature bypass, and privilege escalation. The bulletin, reported by The Hacker News, lands as a priority patch for enterprises that run the platform to orchestrate email, SMS, and cross-channel campaigns.

What Adobe Fixed

The headline issue is CVE-2026-104351, a code injection flaw rated 9.9 on the CVSS scale, which sits just shy of the maximum severity. Successful exploitation could allow an attacker to run arbitrary code in the context of the affected application, a scenario that in a marketing platform often translates into access to customer databases, message templates, and connected delivery infrastructure.

The remaining seven flaws round out a cluster of weaknesses that Adobe classifies as critical, spanning security feature bypass and privilege escalation. While the vendor's advisory groups them under the same patch cycle, the practical impact varies: bypass bugs can undermine authentication or authorization controls, while privilege escalation issues let a lower-privileged user climb to administrative capabilities.

Adobe has not published exploit code or evidence of in-the-wild activity alongside the bulletin, but the severity ratings alone justify treating the update as urgent rather than routine.

Why Campaign Classic Is a High-Value Target

Campaign Classic is not a peripheral tool. It frequently sits at the center of customer communications, holding contact databases, segmentation logic, and integrations with CRM systems and external delivery providers. That makes it attractive to attackers for several reasons:

  • Data concentration. Marketing platforms aggregate personal data at scale, making them a rich source for exfiltration or follow-on phishing campaigns.
  • Trusted sending reputation. An attacker who gains control of a campaign platform can send convincing messages from a legitimate, authenticated domain.
  • Lateral movement potential. Integrations with internal systems and third-party services can provide a foothold deeper into the corporate environment.

Code injection in this context is particularly dangerous because it can convert a single vulnerable endpoint into a persistent foothold, allowing an adversary to manipulate outbound communications or quietly harvest recipient data.

Recommended Actions for Defenders

Organizations running Campaign Classic should treat this update as a priority. Practical steps include:

  1. Apply the patch promptly. Confirm the fixed build matches your deployment model, since Campaign Classic is offered both as a hosted service and in on-premises or hybrid configurations.
  2. Verify exposure. Inventory internet-facing instances and administrative interfaces, then restrict access to trusted networks or VPN where feasible.
  3. Review accounts and roles. Given the privilege escalation flaws, audit administrative accounts and remove unnecessary elevated permissions.
  4. Hunt for anomalies. Check logs for unexpected code changes, unusual outbound sending volumes, or new integrations that were not authorized.
  5. Rotate secrets. If compromise is suspected, rotate credentials and API keys associated with the platform and its connected services.

The Broader Pattern

This bulletin continues a steady drumbeat of critical fixes for enterprise marketing and customer data platforms, which are increasingly scrutinized by both researchers and threat actors. Vendors have responded with more frequent patch cycles, but the operational challenge remains: these systems are often managed by marketing teams rather than security teams, which can slow the path from advisory to deployment.

Security leaders should ensure that marketing-owned infrastructure is included in vulnerability management workflows and asset inventories. A nine-plus severity code injection flaw in a system holding customer data deserves the same urgency as a critical issue in a public-facing web server.

Adobe's advisory is the authoritative source for affected versions and remediation details. Administrators should consult it directly and confirm their deployments are on a patched build before the next campaign cycle begins.