Full Report
Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system. It has been described as a case of incorrect authorization that could result in
Analysis Summary
# Vulnerability: Adobe Campaign Classic Arbitrary Code Execution
## CVE Details
- **CVE ID:** CVE-2026-48449
- **CVSS Score:** 10.0 (Critical)
- **CWE:** Incorrect Authorization (CWE-862)
## Affected Systems
- **Products:** Adobe Campaign Classic (ACC)
- **Versions:** Versions prior to v7: 7.4.3 build 9398
- **Configurations:** Enterprise-focused marketing automation platform running on Windows and Linux.
## Vulnerability Description
CVE-2026-48449 is a maximum-severity flaw caused by incorrect authorization. This vulnerability allows an attacker to execute arbitrary code within the context of the current user. Notably, the flaw can be triggered without any user interaction, making it highly dangerous for automated enterprise environments.
## Exploitation
- **Status:** Not exploited in the wild (as of report date); no public PoC currently mentioned.
- **Complexity:** Low (implied by "no user interaction required" and CVSS 10.0).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** Critical (Full access to data accessible by the current user context).
- **Integrity:** Critical (Ability to modify system files and execute arbitrary commands).
- **Availability:** Critical (Potential for complete system takeover or service disruption).
## Remediation
### Patches
Adobe recommends upgrading to the following version or later:
- **Adobe Campaign Classic v7:** Update to 7.4.3 build 9398 (for Windows and Linux).
### Workarounds
No specific workarounds were provided in the advisory; immediate patching is the primary recommended mitigation.
## Detection
- **Indicators of Compromise:** Monitor for unusual execution of system shells or scripts originating from the ACC service account.
- **Detection methods and tools:** Audit application logs for unauthorized access attempts or exploit patterns related to incorrect authorization bypasses. Check for secondary high-severity activity such as SQL injection (related CVE-2026-48448).
## References
- **Adobe Security Advisory:** hxxps[://]helpx[.]adobe[.]com/security/products/campaign/apsb26-114[.]html
- **The Hacker News Report:** hxxps[://]thehackernews[.]com/2026/08/adobe-campaign-classic-cvss-100-flaw[.]html