Adobe Campaign Classic'da muvaffaqiyatli foydalanilganda ixtiyoriy kod bajarilishi, xavfsizlik funksiyasini chetlab o'tish va imtiyozlarni oshirishga olib kelishi mumkin bo'lgan bir nechta muhim xavfsizlik kamchiliklarini tuzatish uchun yamoqlarni e'lon qildi.
Sakkizta zaiflik ro'yxati quyidagicha -
- CVE-2026-104351 (CVSS balli: 9.9) - Ixtiyoriy kod bajarilishiga olib kelishi mumkin bo'lgan kod in'ektsiyasi zaifligi.
- CVE-2026-104353 (CVSS balli: 9.9) - Ixtiyoriy kod bajarilishiga olib kelishi mumkin bo'lgan operatsion tizim kod in'ektsiyasi zaifligi.
- CVE-2026-105780 (CVSS balli: 9.9) - Ixtiyoriy kod bajarilishiga olib kelishi mumkin bo'lgan noto'g'ri avtorizatsiya zaifligi.
- CVE-2026-105489 (CVSS balli: 9.9) - Xavfsizlik funksiyasini chetlab o'tishga olib kelishi mumkin bo'lgan SQL in'ektsiyasi zaifligi.
- CVE-2026-105781 (CVSS balli: 9.8) - Xavfsizlik funksiyasini chetlab o'tishga olib kelishi mumkin bo'lgan SQL in'ektsiyasi zaifligi.
- CVE-2026-104350 (CVSS balli: 9.3) - Imtiyozlarni oshirishga olib kelishi mumkin bo'lgan aks ettirilgan (reflected) saytlararo skriptlash (XSS) zaifligi.
- CVE-2026-104354 (CVSS balli: 9.1) - Xavfsizlik funksiyasini chetlab o'tishga olib kelishi mumkin bo'lgan SQL in'ektsiyasi zaifligi.
- CVE-2026-105779 (CVSS balli: 9.1) - Xavfsizlik funksiyasini chetlab o'tishga olib kelishi mumkin bo'lgan SQL in'ektsiyasi zaifligi.
Muammolar Windows va Linux uchun Adobe Campaign Classic 7.4.4 build 9402 va undan oldingi versiyalariga ta'sir qiladi. Ular 7.4.4 build 9403 versiyasida tuzatilgan.
Shuningdek, Adobe tomonidan Windows, macOS va Android uchun Adobe Connect Desktop va Mobile'dagi muhim kod in'ektsiyasi kamchiligi (CVE-2026-48360, CVSS balli: 9.6) ham tuzatildi, bu ixtiyoriy kod bajarilishiga olib kelishi mumkin.
Zaiflik quyidagi versiyalarda tuzatilgan -
- Adobe Connect Desktop -
- Windows: 2026.9.61 versiyasi
- macOS Silicon: 2026.10.66 versiyasi
- macOS Intel: 2026.10.170 versiyasi
- Android uchun Adobe Connect Mobile 4.5 versiyasi
Adobe yangilanishda hal qilingan "hech bir muammo bo'yicha yovvoyi tabiatda foydalanish holatlari haqida xabardor emas"ligini aytdi. Foydalanuvchilarga optimal himoya uchun eng so'nggi versiyaga yangilash tavsiya etiladi.
Adobe has released patches to address multiple critical security flaws in Campaign Classic that, if successfully exploited, could result in arbitrary code execution, security feature bypass, and privilege escalation.
The list of eight vulnerabilities is as follows -
- CVE-2026-104351 (CVSS score: 9.9) - A code injection vulnerability that could lead to arbitrary code execution.
- CVE-2026-104353 (CVSS score: 9.9) - An operating system code injection vulnerability that could lead to arbitrary code execution.
- CVE-2026-105780 (CVSS score: 9.9) - An incorrect authorization vulnerability that could lead to arbitrary code execution.
- CVE-2026-105489 (CVSS score: 9.9) - An SQL injection vulnerability that could lead to security feature bypass.
- CVE-2026-105781 (CVSS score: 9.8) - An SQL injection vulnerability that could lead to security feature bypass.
- CVE-2026-104350 (CVSS score: 9.3) - A reflected cross-site scripting vulnerability that could lead to privilege escalation.
- CVE-2026-104354 (CVSS score: 9.1) - An SQL injection vulnerability that could lead to security feature bypass.
- CVE-2026-105779 (CVSS score: 9.1) - An SQL injection vulnerability that could lead to security feature bypass.
The issues affect Adobe Campaign Classic versions 7.4.4 build 9402 and earlier for Windows and Linux. They have been patched in version 7.4.4 build 9403.
Also resolved by Adobe is a critical code injection flaw in Adobe Connect Desktop and Mobile for Windows, macOS, and Android (CVE-2026-48360, CVSS score: 9.6) that could result in arbitrary code execution.
The vulnerability has been fixed in the following versions -
- Adobe Connect Desktop -
- Windows: version 2026.9.61
- macOS Silicon: version 2026.10.66
- macOS Intel: version 2026.10.170
- Adobe Connect Mobile for Android version 4.5
Adobe said it's not "aware of any exploits in the wild for any of the issues" addressed in the update. Users are advised to update to the latest version for optimal protection.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.