[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

official (Adobe APSB26-162, Oct 27); no known exploitation

Adobe Campaign Classic APSB26-162 patches eight critical flaws (code injection, SQLi, XSS, auth bypass), CVSS up to 9.9; update to 7.4.4 build 9403

Adobe's Oct 27 priority-2 bulletin APSB26-162 covers Adobe Campaign Classic ACC v7 7.4.4 build 9402 and earlier on Windows and Linux. The fixed build is 7.4.4 build 9403. Adobe says it is not aware of exploits in the wild.

  • CVE-2026-104351 (9.9) — code injection → arbitrary code execution
  • CVE-2026-104353 (9.9) — OS command injection → arbitrary code execution
  • CVE-2026-105780 (9.9) — incorrect authorization → arbitrary code execution
  • CVE-2026-105489 (9.9) and CVE-2026-105781 (9.8) — SQL injection → security feature bypass
  • CVE-2026-104350 (9.3) — reflected XSS → privilege escalation
  • CVE-2026-104354 (9.1) and CVE-2026-105779 (9.1) — SQL injection → security feature bypass

Campaign Classic often sits on marketing and customer databases. Treat internet-facing or poorly segmented instances as urgent, then roll the build through the rest of the estate.

Sources: Adobe: APSB26-162 Security update available for Adobe Campaign Classic (Oct 27) · The Hacker News: Adobe Fixes 8 Critical Campaign Classic Flaws (Oct 28)