CVE-2026-105489

Summary

Adobe Campaign Classic contains an SQL injection flaw (CWE-89) in which a low-privileged attacker can inject malicious SQL into backend queries without user interaction, leading to arbitrary code execution in the current user's context with expanded scope.

Exploitability

Exploitation is straightforward for a low-privileged attacker due to lack of input sanitization and does not require user interaction or elevated privileges.

Blast radius

Successful exploitation could allow full compromise of the application server, including theft of sensitive data, unauthorized modification of campaign workflows, and potential lateral movement within connected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Adobe Campaign Classic version 2.590 or later, as this is the first fixed version addressing CVE-2026-105489.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.