CVE-2026-82011: Adobe Campaign Classic SQL Injection Flaw

CVE-2026-82011 Overview

Adobe Campaign Classic (ACC) contains an SQL Injection vulnerability [CWE-89] that allows a low-privileged attacker to bypass security controls over the network. The flaw stems from improper neutralization of special elements in SQL commands processed by the application. Successful exploitation grants unauthorized read access and limited write access to backend database contents. Exploitation requires no user interaction, and the vulnerability has a changed scope, meaning compromise extends beyond the vulnerable component. Adobe published advisory APSB26-142 addressing this issue.

Critical Impact
An authenticated attacker with low privileges can bypass security features and access database contents remotely without user interaction, with impact extending beyond the Campaign Classic component.

Affected Products

Adobe Campaign Classic (ACC) versions up to and including 7.4.4 build 9401
Adobe Campaign Classic on Microsoft Windows
Adobe Campaign Classic on Linux

Discovery Timeline

2026-09-22 - CVE-2026-82011 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-82011

Vulnerability Analysis

The vulnerability resides in Adobe Campaign Classic's handling of user-supplied input that reaches SQL query construction. The application fails to properly neutralize special SQL characters before incorporating input into database queries. An attacker with low-privileged authenticated access can craft input containing SQL metacharacters to alter query logic.

Because the scope is changed, exploitation impacts resources beyond the ACC component itself, extending the blast radius to adjacent systems the database may access. The vulnerability yields high confidentiality impact, with limited integrity and availability impact. Adobe classifies the outcome as a security feature bypass, indicating the injection is used to circumvent authorization or validation logic rather than only exfiltrate rows.

Root Cause

The root cause is improper input sanitization when constructing SQL statements, categorized under [CWE-89]. Instead of using parameterized queries or a strict allowlist for input validation, the affected code paths concatenate untrusted values into SQL commands. This allows attacker-controlled fragments to be interpreted as SQL syntax rather than data literals.

Attack Vector

An attacker requires low-privileged authenticated access to the Campaign Classic application over the network. The attacker submits crafted parameters through legitimate application interfaces that reach vulnerable query builders. The injected SQL alters the query semantics to read arbitrary data or perform limited write operations that bypass application-layer security controls. No user interaction is required for exploitation. Refer to the Adobe Security Advisory APSB26-142 for detailed technical context.

Detection Methods for CVE-2026-82011

Indicators of Compromise

Unexpected SQL syntax tokens such as UNION SELECT, --, ;, or OR 1=1 in Campaign Classic application logs and HTTP request parameters.
Database audit logs showing queries originating from the Campaign service account that access tables outside normal application workflows.
Anomalous read volume or unexpected write operations from ACC application user contexts against sensitive tables.
Authenticated ACC sessions from low-privileged accounts issuing repeated crafted requests against the same endpoint.

Detection Strategies

Enable database query logging on the ACC backend and alert on syntactically malformed or unusually long parameterized queries.
Deploy a Web Application Firewall (WAF) rule set targeting SQL injection signatures on Campaign Classic endpoints.
Correlate application authentication events with subsequent database query anomalies to identify low-privileged account misuse.
Baseline legitimate ACC query patterns and alert on deviations, particularly queries touching authentication or authorization tables.

Monitoring Recommendations

Monitor the Campaign Classic application server access logs for HTTP requests containing SQL metacharacters in query parameters or POST bodies.
Track database connection metadata for unusual query duration, row counts, or error rates from the ACC service account.
Alert on any privilege changes, credential reads, or configuration table modifications performed via ACC-originated queries.

How to Mitigate CVE-2026-82011

Immediate Actions Required

Apply the security update referenced in Adobe advisory APSB26-142 to all Adobe Campaign Classic instances immediately.
Inventory all ACC deployments on both Windows and Linux hosts, including versions 7.4.4-9400 and 7.4.4-9401, and prioritize patching internet-exposed instances.
Rotate credentials and API keys for the Campaign Classic database service account after patching, in case of prior compromise.
Review database and application audit logs for indicators of exploitation dating back to the affected version's deployment.

Patch Information

Adobe released a fix in security advisory APSB26-142. Administrators must upgrade Adobe Campaign Classic to the patched build listed in the advisory. Confirm the update by validating the installed version against the fixed release notes provided by Adobe.

Workarounds

Restrict network access to the Campaign Classic application to trusted management networks only, using firewall rules or VPN gating.
Deploy a WAF in front of ACC with SQL injection protections tuned to the application's expected parameter patterns.
Enforce the principle of least privilege on the database account used by Campaign Classic, removing rights to sensitive tables where feasible.
Disable or remove low-privileged ACC accounts that are not actively required until patching is complete.

bash

# Example: restrict ACC application port to management subnet using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP