CVE-2026-82009 is a critical (9.1) SQL injection in Adobe Campaign Classic. An attacker with high privileges could run arbitrary SQL, which could lead to code execution as the current user, and the scope is changed. Adobe's bulletin APSB26-142 names the fixed build, so apply that update.
What's affected
The record lists Adobe Campaign Classic (ACC) on Windows and Linux, and points to Adobe security bulletin APSB26-142. My attempt to load the bulletin was blocked, so I cannot state the affected and fixed build numbers here. Read APSB26-142 for the exact versions and the update you need.
The record does not give version numbers, so do not rely on this post for them. Adobe publishes the fixed build in its bulletin.
How to check if you're exposed
Find your Campaign Classic servers and their build number. In the Campaign Classic client, the version appears in the Help menu under About. Compare it to the fixed build in APSB26-142.
Also check who can reach the server. The record says exploitation needs no user interaction and the scope is changed, which means the effect can reach beyond the Campaign component itself.
What to do now
- Inventory every Adobe Campaign Classic instance, including staging and test.
- Read Adobe bulletin APSB26-142 for the fixed build and Adobe's priority rating.
- Apply the update on all servers, following Adobe's upgrade steps.
- Limit network access to Campaign Classic servers to the users and systems that need it.
- Review database and server logs for activity you cannot explain, since the record involves database and internal resource access.
Why it matters
The weakness is CWE-89, improper neutralization of special elements used in an SQL command. The record scores it critical mainly because of the changed scope and full impact, even though the attacker needs high privileges.
That privilege requirement narrows who can exploit it, but does not remove the risk. Compromised administrator accounts are a common starting point. The record is not listed in CISA's KEV catalog. Two related records in the same bulletin, CVE-2026-82443 and CVE-2026-83660, involve server-side request forgery.
A high privilege requirement changes who the attacker is, not whether the flaw matters. In marketing platforms such as Campaign Classic, many people hold operator or administrator roles, including agencies and contractors. An SQL injection that needs that level of access is still a path from one compromised account to the database and the host.
The record notes that the scope is changed and describes arbitrary code execution in the context of the current user. Read that as a reminder to check what account the Campaign service runs as, and what that account can reach. A service account with broad file system or network access makes every flaw in the product worse.
Because I could not read Adobe's bulletin, confirm the fixed build and the update path there. Adobe also assigns a priority rating in each bulletin, which tells you how quickly Adobe expects customers to patch.
Quick check
Does the high privilege requirement make this low risk?
It lowers the number of people who can exploit it, but stolen admin credentials are common. Patch it with the rest of the bulletin.
Sources
Last reviewed: 19 October 2026.
