CVE-2026-82010: Adobe Campaign Classic SQLI Vulnerability

CVE-2026-82010 Overview

Adobe Campaign Classic (ACC) contains a SQL injection vulnerability [CWE-89] that allows a low-privileged, authenticated attacker to execute arbitrary code in the context of the current user. The flaw stems from improper neutralization of special elements in SQL commands processed by the application. Exploitation requires no user interaction and can be performed remotely over the network. Adobe published security bulletin APSB26-142 addressing the issue.

Critical Impact
A network-based attacker with low privileges can achieve arbitrary code execution and cross security boundaries because the vulnerability changes scope, exposing confidentiality, integrity, and availability of adjacent components.

Affected Products

Adobe Campaign Classic (ACC) versions up to and including 7.4.4-9401
Adobe Campaign Classic on Microsoft Windows
Adobe Campaign Classic on Linux

Discovery Timeline

2026-09-22 - CVE-2026-82010 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-82010

Vulnerability Analysis

Adobe Campaign Classic fails to neutralize special characters supplied through an SQL-bearing input path. An authenticated attacker with low privileges submits a crafted payload that the application concatenates into a database query without proper parameterization. The injected statement executes with the privileges of the application's database context, which enables code execution paths beyond simple data disclosure. Because scope changes during exploitation, the attacker can affect resources managed outside the vulnerable component's security authority.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The application constructs SQL statements by string concatenation rather than using prepared statements or parameterized queries. Attacker-controlled input flows directly into the query planner, allowing injected clauses, stacked queries, or database-specific procedures that lead to arbitrary code execution.

Attack Vector

The vulnerability is exploitable over the network against an internet-reachable or intranet-reachable Adobe Campaign Classic instance. An attacker authenticates using any low-privileged account and issues a crafted request to a vulnerable endpoint. No user interaction is required. Because the scope is changed, the attacker can pivot from the Campaign application into the underlying database service and, from there, to the host operating system through database-level command execution primitives.

Adobe has not published proof-of-concept exploit code. See the Adobe Security Patch APSB26-142 for vendor-supplied technical details.

Detection Methods for CVE-2026-82010

Indicators of Compromise

Unexpected SQL syntax patterns in Adobe Campaign application logs, including UNION, stacked semicolons, or comment sequences such as -- and /*
Database processes spawning shell interpreters (cmd.exe, powershell.exe, /bin/sh) on hosts running Adobe Campaign
Outbound network connections initiated by the Campaign application or its database service to unfamiliar destinations
New or modified stored procedures, triggers, or scheduled jobs in the Campaign database not tied to change control

Detection Strategies

Monitor HTTP request bodies and query parameters to Campaign endpoints for SQL metacharacters and encoded variants
Correlate authenticated low-privilege sessions with database error responses that suggest query manipulation
Baseline normal query patterns from the Campaign service account and alert on deviations such as xp_cmdshell calls on SQL Server or COPY ... PROGRAM on PostgreSQL

Monitoring Recommendations

Enable verbose database audit logging for the Campaign service account and forward logs to a centralized analytics platform
Track process ancestry for the Campaign application server and database engine to identify anomalous child processes
Alert on file writes to web-accessible directories by the Campaign or database process identities

How to Mitigate CVE-2026-82010

Immediate Actions Required

Apply the vendor patch referenced in Adobe Security Patch APSB26-142 to all Adobe Campaign Classic instances
Inventory low-privilege accounts with access to Campaign and rotate credentials for any account showing unexpected activity
Restrict network exposure of Campaign management interfaces to trusted administrative networks only
Review database audit logs for evidence of injection attempts predating the patch

Patch Information

Adobe released bulletin APSB26-142 addressing CVE-2026-82010 in Adobe Campaign Classic. Administrators should upgrade beyond the affected 7.4.4-9401 build to the fixed version documented in the advisory. Full patch details are available at the Adobe Security Patch APSB26-142 advisory.

Workarounds

Place a web application firewall in front of Campaign to filter SQL injection patterns in request parameters and bodies
Enforce least privilege on the Campaign database service account by removing rights to spawn OS commands or write to the file system
Disable or restrict any dangerous database features such as xp_cmdshell, COPY PROGRAM, or user-defined functions that permit shell access
Require multi-factor authentication for all Campaign user accounts to raise the bar on obtaining the low-privilege access required for exploitation

bash

# Configuration example: restrict SQL Server xp_cmdshell as a defense-in-depth measure
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;