{"id":"CVE-2026-105489","published":"2026-10-27T17:16:56.080","lastModified":"2026-10-27T17:16:56.080","description":"Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://www.adobe.com/trust/security/products/campaign/apsb26-162.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Adobe Campaign Classic contains an SQL injection flaw (CWE-89) in which a low-privileged attacker can inject malicious SQL into backend queries without user interaction, leading to arbitrary code execution in the current user's context with expanded scope.","exploitability":"Exploitation is straightforward for a low-privileged attacker due to lack of input sanitization and does not require user interaction or elevated privileges.","blast_radius":"Successful exploitation could allow full compromise of the application server, including theft of sensitive data, unauthorized modification of campaign workflows, and potential lateral movement within connected systems.","remediation":"Upgrade to Adobe Campaign Classic version 2.590 or later, as this is the first fixed version addressing CVE-2026-105489.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","rce","low-priv-exploit","no-user-interaction","web"],"model":"garnet-coder","analyzedAt":"2026-10-28T09:57:19.116Z"}}