CVE-2026-48449: Adobe Campaign Classic RCE

Adobe Campaign Classic is affected by CVE-2026-48449, a critical incorrect authorization vulnerability allowing Remote Code Execution (RCE). With a maximum severity score, this flaw presents a severe risk to confidentiality, integrity, and availability for unpatched systems. This article examines the vulnerability’s technical specifications, the systems at risk, and the essential steps required for effective remediation.

What Is CVE-2026-48449?

CVE-2026-48449 (CVSS 10.0) affects Adobe Campaign Classic v7 and is classified as an Incorrect Authorization vulnerability (CWE-863). Adobe has assigned it a Critical severity rating due to its potential for full system compromise.

Adobe publishes this CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The vector indicates network reachability, low attack complexity, no privileges required, no user interaction, changed security scope, and high confidentiality, integrity, and availability impact. NVD’s descriptive text refers to execution in the context of the current user, so the vector should not be treated as proof that every deployment is exposed without environmental restrictions.

In plain language, the application appears to inadequately verify authorization before allowing access to functionality that can lead to code execution. Adobe has not publicly identified the specific endpoint, component, request format, code path, or operating-system execution context involved.

The same advisory also addresses CVE-2026-48448 (CVSS 8.6), a separate vulnerability in Adobe Campaign Classic classified as SQL injection (CWE-89). This flaw can lead to arbitrary file-system reads and should be remediated by applying the same software update used for CVE-2026-48449.

Which Adobe Campaign Classic Versions Are Affected?

Adobe’s bulletin identifies the following affected and fixed versions:

The update applies to:

• Fully on-premises Adobe Campaign Classic deployments.
• On-premises components of hybrid deployments.
• Customer-managed Campaign Classic v7 systems running build 9397 or earlier.

Adobe states that its hosted instances have already been remediated and require no customer action. Organizations should still verify whether each instance is Adobe-hosted, hybrid, or fully on-premises, since customer-managed components remain within the patch scope.

What Component Is Vulnerable?

The confirmed vulnerability category is an authorization failure, not a publicly documented weakness in a named Campaign Classic module. The available Adobe and NVD records do not identify the affected interface or explain precisely how the authorization logic fails.

That limitation matters for defenders. It is not currently possible to create a reliable endpoint-specific detection rule or identify a particular request pattern from the published information. However, the combination of an authorization weakness and arbitrary code execution creates a serious risk if an attacker can reach the relevant Campaign Classic service.

Adobe’s CVSS assessment also assigns changed security scope, meaning exploitation could affect resources beyond the vulnerable security authority. The practical impact depends on the deployment’s network exposure and the permissions available to the Campaign Classic service, which Adobe has not detailed publicly.

How Could CVE-2026-48449 Be Exploited in Practice?

At a high level, an attacker would need to reach a vulnerable Campaign Classic function and bypass the authorization control protecting it. If successful, the flaw could allow code execution in the affected application context, with potential consequences for application data, files, and other resources accessible to the service.

The published material does not support identifying a specific exploit chain, payload mechanism, operating-system command, or affected endpoint. No exploit instructions or procedural details should be inferred from the CVSS vector alone.

No credible public proof of concept, exploit repository, exploit-framework module, or technical write-up specifically tied to CVE-2026-48449 was identified in the sources reviewed as of August 3, 2026. This does not establish that private exploit code does not exist.

Is CVE-2026-48449 Being Exploited in the Wild?

Adobe stated it was not aware of exploits in the wild for the vulnerabilities addressed by APSB26-114, and no confirmed exploitation has been reported at the time of writing.

SOCRadar’s Cyber Threat Intelligence and Attack Surface Management capabilities can help teams track vulnerability status, identify customer-managed Adobe Campaign Classic assets, and prioritize instances that are externally reachable or exposed beyond controlled administrative networks.

What Should Defenders Do Now?

Patch Customer-Managed Installations

Upgrade affected Adobe Campaign Classic v7 installations to 7.4.3 build 9398 or the newest release recommended by Adobe. Patch priority should be highest for systems that are internet reachable, accessible from untrusted networks, or broadly reachable inside enterprise environments.

Recommended actions include:

• Inventory all Adobe Campaign Classic v7 deployments and record their build numbers.
• Identify systems running build 9397 or earlier.
• Patch fully on-premises installations.
• Patch the on-premises components of hybrid deployments.
• Confirm whether hosted instances are covered by Adobe’s remediation statement.
• Preserve relevant logs before patching if the environment may require incident review.

Adobe does not specify a workaround or vulnerability-specific compensating control in the bulletin. Network restrictions and segmentation can reduce exposure temporarily, but they should not replace the vendor update.

Reduce Exposure While Patching

Where operationally possible:

• Restrict access to Campaign Classic services to approved administration and application networks.
• Review firewall and reverse-proxy rules for unnecessary external reachability.
• Limit access from untrusted network segments.
• Confirm that administrative and integration interfaces are not exposed more broadly than required.

These measures address reachability, not the authorization defect itself. A vulnerable service may remain at risk from an attacker who can access it through an allowed network path.

Hunt for Suspicious Activity

Adobe does not provide indicators of compromise, affected endpoint names, exploit signatures, or detailed hunting queries. Defenders should therefore combine application, web, authentication, and host telemetry.

Review:

• Campaign Classic and web-server logs for unusual requests involving administrative, configuration, integration, or code-processing functionality.
• Authentication and authorization events showing unexpected access patterns or requests from untrusted networks.
• Process-creation telemetry for unexpected child processes launched by Campaign Classic services.
• File integrity and endpoint telemetry for new or modified scripts, binaries, scheduled tasks, services, or persistence mechanisms.
• Outbound network connections, file writes, and privilege changes that correlate with anomalous application requests.
• Application inventory data confirming that systems now run build 9398 or later.

These checks are behavioral rather than signature-based because the public technical details do not support a reliable exploit-specific indicator.

Organizations should treat CVE-2026-48449 as a high-priority remediation target, particularly when customer-managed instances are externally or broadly reachable. Exploitation has not been confirmed, but the modeled network reachability, low complexity, lack of user interaction, and potential for arbitrary code execution justify prompt patching and post-update validation.