Adobe patched two critical Campaign Classic flaws, including CVE-2026-48449 (CVSS 10.0) and CVE-2026-48448 (CVSS 8.6); users should upgrade immediately.
Adobe recently released a security update for Campaign Classic and classified the patch as Priority 1, requiring users to deploy the new version as soon as possible.[5][1] According to the public security bulletin, this release fixes two critical vulnerabilities in Campaign Classic. CVE-2026-48449 has a CVSS score of 10.0 and is an Incorrect Authorization issue that could lead to arbitrary code execution without requiring user interaction.[9][15] The other vulnerability, CVE-2026-48448, is an SQL Injection issue with a CVSS score of 8.6, which could allow an attacker to read sensitive data from the system and further affect system access privileges.[9][15]
Viewed in context, Adobe's risk assessment for Campaign Classic is not conservative; instead, it is being handled at the highest severity level, which indicates that the company considers the product a highly exposed attack surface.[5][2] If Adobe's other Campaign Classic patch records from the same period are taken into account, the product has previously had CVSS 10.0 vulnerabilities caused by incorrect authorization that could be used for arbitrary code execution, showing that authorization control has long been a major security focus for this platform.[2][4]
The core issue in CVE-2026-48449 is Incorrect Authorization, meaning the system fails to properly restrict unauthorized access to specific functions or resources.[9][1] This type of weakness is usually not just a simple input-format error, but rather a design or implementation flaw in the privilege verification process, allowing a remote attacker to send a crafted request and trigger high-privilege actions without a valid account or interactive verification.[1][15] In Adobe's bulletin, the impact of the vulnerability is described as arbitrary code execution, and the CVSS vector also indicates network accessibility, low attack complexity, no privileges required, and no user interaction, which is the main reason the score is 10.0.[9][5]
The danger of this type of flaw is that it does not stop at data leakage; it can directly cross into system control.[1][15] Once an attacker can execute arbitrary code with existing service privileges, they may be able to install backdoors, manipulate workflows, modify data, or move laterally to nearby systems; although these follow-on actions are not individually listed in the source, they are common direct inferences from arbitrary code execution, assuming the vulnerability has been successfully exploited.[1][5]
CVE-2026-48448 is a classic SQL Injection problem, caused by improper handling of SQL special characters.[9][15] According to Adobe, this vulnerability could lead to arbitrary file system read and has a risk score of 8.6.[9] From a technical perspective, SQL Injection typically first allows an attacker to manipulate database query logic and then expands into data disclosure, privilege bypass, or probing of the data structure; in this case, the fact that it is specifically marked as capable of reading file system contents means the attack surface is not limited to the database layer and may also affect the application's underlying data access flow.[9][15]
Seen together, the two vulnerabilities show that the risk in Campaign Classic does not come from a single input point, but from systemic gaps in both authorization verification and query handling.[5][9] For enterprises, this combination is especially troublesome because an attacker may first exploit the high-privilege weakness to gain execution opportunities and then use the data access flaw to collect information or expand the impact; however, this multi-stage exploitation chain is not explicitly confirmed by the original source and should therefore be treated as a reasonable technical inference rather than an established fact.[9][15]
Based on public information, the affected product is Adobe Campaign Classic, and Adobe's update bulletin specifically targets the relevant product family.[5][9] Existing information shows that the affected version is ACC v7: 7.4.3 build 9397 and earlier, and the company recommends upgrading to a newer build to fix the authorization issue.[1][3][16] Another source notes that the previous patch build was 9398, while this new bulletin again introduces differently numbered remediation content, indicating that Campaign Classic continues to receive fixes for high-risk defects across multiple bulletin cycles.[4][7]
In terms of deployment model, the advisory applies only to fully on-premise Campaign Classic deployments and the on-premise components of hybrid deployments, while Adobe-hosted instances have already been remediated.[1][7] This means the impact is not limited to a specific cloud service, but also covers enterprise self-hosted and hybrid marketing automation systems.[1][7] For organizations that rely on Campaign Classic for customer segmentation, email scheduling, list management, and content delivery, a compromise could affect not just one server but the entire marketing and customer communication chain.[12][3]
In addition, Campaign Classic is an enterprise marketing automation platform that typically processes large volumes of customer data and campaign content, so arbitrary code execution and sensitive data read issues can magnify the impact of an incident.[3][12] Although the sources do not directly list any real-world victims, the vulnerability type and product role suggest that the main risks usually include customer data exposure, tampering with marketing content, service disruption, and increased compliance pressure.[3][12]
The most direct defense is to immediately apply the latest patched version provided by Adobe, since the company has classified Campaign Classic as Priority 1, meaning remediation should be treated as urgent.[5][1] If the environment is still on an affected version, first confirm whether it falls within the older versions listed in the bulletin, then upgrade according to Adobe's guidance to a fixed build.[1][4][7]
Second, Campaign Classic should be treated as a high-risk externally exposed application, and its network exposure and access controls should be reviewed immediately.[9][4] Because CVE-2026-48449 can be triggered without user interaction, relying only on credentials or user behavior is not sufficient protection, so the environment should also use minimal exposure, necessary network segmentation, and strict isolation of administrative interfaces.[1][5] For organizations running on-premise or hybrid deployments, the management entry points should be confirmed as internal-only wherever possible.[1][7]
Third, monitoring and auditing should be strengthened, especially for abnormal requests, unexpected data queries, authorization failures, and suspicious code execution signs.[1][15] Although the sources do not provide specific detection rules, the vulnerability characteristics reasonably suggest that if an attacker attempts to exploit Incorrect Authorization or SQL Injection, logs will often contain abnormal URLs, parameter patterns, query errors, or permission-denied messages.[9][15] Identifying and containing these events early can help shorten the exposure window between detection and patching.[5][9]
Fourth, surrounding systems integrated with Campaign Classic should be reviewed at the same time, including database account privileges, file system access rights, and service account authorization scope.[9] Because CVE-2026-48448 involves reading system contents, excessive service privileges may further increase damage once the application layer is manipulated.[9][15] Least privilege, separate accounts, and regular review of sensitive paths are important ways to reduce follow-on impact.
Fifth, this incident should be incorporated into patch governance and vulnerability management processes, with an accelerated response mechanism for vulnerabilities rated CVSS 9 or higher.[5][9] Adobe has repeatedly had CVSS 10.0-level vulnerabilities in Campaign Classic, showing that this product deserves a long-term high-priority watchlist.[2][4] Organizations that depend on centralized content delivery or customer communication should standardize patching, rollback, and validation procedures to avoid letting a single high-risk weakness disrupt overall operations.