Dell advisory DSA-2026-416 and Adobe bulletins APSB26-162 and APSB26-182, published October 27 to 28, 2026
Backup and Campaign Platforms Take the Top Scores: Dell PowerProtect at 9.8, Adobe Campaign Classic at 10.0
Two vendor releases this week cover systems attackers value for what they hold. Dell advisory DSA-2026-416 for PowerProtect Data Domain, the backup appliance line, is led by CVE-2026-86400 (CVSS 9.8), which lets an attacker with no login run commands as root; the fixed releases are DD OS 8.9.0.0 for the feature release line, 7.13.1.90 for LTS2024, 8.3.1.50 for LTS2025, and 8.6.1.30 for LTS2026. The same Dell advisory covers further flaws published October 28, including CVE-2026-86384, a use of a hard-coded cryptographic key under which an unauthenticated remote attacker can expose credentials and then use them to access the system with the privileges of the compromised user, across feature release versions 7.7.1.0 through 8.8 and the corresponding LTS lines. Adobe, in bulletins dated October 27, fixed nine critical flaws across Campaign Classic and Connect, none of which Adobe lists as exploited. Campaign Classic v7 at 7.4.4 build 9402 and earlier moves to build 9403: the set is led by an SQL injection flaw rated 10.0 (CVE-2026-105781) and three flaws rated 9.9 that reach arbitrary code execution, covering code injection (CVE-2026-104351), operating system command injection (CVE-2026-104353), and incorrect authorization (CVE-2026-105780), plus further SQL injection flaws and a reflected cross-site scripting flaw rated 9.3. Adobe Connect carries a separate critical code injection flaw, CVE-2026-48360, rated 9.6, fixed in the current desktop and mobile releases. Campaign platforms hold customer databases and Connect carries internal meetings, so both sit closer to sensitive data than their marketing and meeting labels suggest.
Executives
Backups are the recovery plan and campaign platforms are the customer list, and both received top-score flaws in the same week. Neither set is reported as exploited, which is exactly when patching is cheapest. Ask for the upgrade dates for your Data Domain appliances and any self-hosted Campaign Classic install, and for confirmation that backup administration uses accounts separate from ordinary domain logins.
CIO / CISO
Sequence by exposure and value: internet-reachable Campaign Classic first to build 9403 with a server restart afterward, then Data Domain appliances to the DSA-2026-416 fixed releases, with management interfaces confirmed on an isolated network in both cases. For the Dell hard-coded key flaw, patching alone is not the whole answer: credentials the key could have exposed should be treated as exposed and rotated once the fixed release is in place.
Engineers
On Data Domain, verify the running DD OS against your branch line rather than the headline version, because the fixed build differs across the feature, LTS2024, LTS2025, and LTS2026 lines. On Campaign Classic, inventory any internet-facing application servers before the build 9403 update and re-check reachability afterward. Update Adobe Connect desktop and mobile clients through the normal software channel so the 9.6 fix does not wait on user initiative.
Everyone (non-IT)
If the tool your team uses for email campaigns or online meetings updates this week, install it promptly. Software that touches customer lists and meeting content gets the same careful treatment as software that touches money.