Adobe has issued an urgent security update for Adobe Campaign Classic after disclosing a maximum-severity vulnerability that could allow arbitrary code execution without user interaction. The flaw, tracked as CVE-2026-48449, has been assigned a CVSS score of 10.0, the highest possible rating, and should be treated as a priority patching event by any organization running Campaign Classic in production or connected enterprise environments.

Adobe Campaign Classic is commonly used for marketing automation, customer engagement workflows, and campaign orchestration. Because these platforms often integrate with customer databases, email infrastructure, analytics systems, and internal business applications, a code execution flaw in this tier can create risk well beyond the application itself. Even if the affected server is not internet-facing, attackers who gain a foothold elsewhere in the network may look for high-value application servers like ACC to expand access.

What Adobe Fixed

According to the report, the primary issue is an incorrect authorization vulnerability in Adobe Campaign Classic. In practical terms, authorization weaknesses occur when software fails to properly enforce who is allowed to perform a sensitive action. When that failure is tied to code execution, the result can be severe: an attacker may be able to run commands or code in the context of the current user or service account.

The concerning part of CVE-2026-48449 is that exploitation does not require user interaction. That means defenders should not rely on phishing resistance, user awareness, or reduced click risk as compensating controls. If an attacker can reach the vulnerable component and satisfy the technical conditions for exploitation, the attack path may not require a victim to open a file, click a link, or approve a prompt.

Adobe also addressed CVE-2026-48448, a high-severity SQL injection issue with a reported CVSS score of 8.6. That vulnerability could enable arbitrary file reads. SQL injection in enterprise applications remains dangerous because it may expose sensitive database content, configuration data, credentials, or files that help an attacker move from application-layer access to broader compromise.

The fixes are available in Adobe Campaign Classic v7 version 7.4.3 build 9398 for Windows and Linux. Adobe reportedly stated that it is not aware of active exploitation in the wild at the time of disclosure, but the absence of known exploitation should not be interpreted as low risk. Public disclosure of a CVSS 10.0 bug often increases attacker interest quickly.

Why This Matters for Enterprise Environments

Marketing automation systems can be deceptively sensitive. They may not always sit in the same mental category as identity platforms, payment systems, or core databases, but they frequently process customer records, segmentation data, campaign logic, templates, authentication secrets, and API integrations. Many are also granted outbound access to mail systems, CRM platforms, data warehouses, or file shares.

If an attacker can execute code on an ACC host, the immediate concern is compromise of the application server. The next concern is what that server can access. Service accounts used by campaign platforms are sometimes overprivileged because integrations are added over time and permissions are rarely revisited. A successful exploit could therefore become a stepping stone to data theft, credential harvesting, unauthorized campaign activity, or lateral movement.

The SQL injection flaw adds a second risk path. Even when code execution is not achieved, arbitrary file read can reveal configuration files, logs, keys, database connection strings, or other secrets that make future compromise easier. Security teams should treat both vulnerabilities as part of the same incident-prevention window rather than patching only the headline CVSS 10.0 issue.

Recommended Actions

Organizations using Adobe Campaign Classic should first identify every ACC instance, including test, staging, disaster recovery, and legacy environments. Security teams should confirm the exact version and build number, then upgrade affected installations to v7 7.4.3 build 9398 or later according to Adobe’s guidance.

After patching, administrators should review whether ACC servers are exposed to unnecessary networks. Limit inbound access to trusted administrative and application paths, and use network segmentation to prevent broad internal reachability. If remote administrative interfaces are available, ensure they are protected by strong authentication, logging, and access controls.

Because the vulnerability may allow code execution in the context of the current user, review the privileges assigned to ACC service accounts. Remove unnecessary local administrator rights, database privileges, file share access, and broad API scopes. Rotate credentials or API tokens that are stored on or used by ACC servers, especially if there is any indication the system may have been probed before patching.

Defenders should also examine logs for suspicious activity. Useful signals may include unexpected process launches from application directories, unusual outbound connections, new scheduled tasks, modified campaign scripts, abnormal database queries, authentication failures followed by success, and reads of configuration or sensitive files. If centralized logging is available, compare recent ACC activity against a known-good baseline.

Adobe Bridge Updates Also Released

Adobe also released fixes for several critical-rated Adobe Bridge vulnerabilities, including issues involving untrusted search paths, incorrect authorization, path traversal, out-of-bounds writes, arbitrary code execution, and privilege escalation. While Adobe Bridge may not be as central to enterprise operations as Campaign Classic, creative and media workflows often involve files from external sources, so endpoint patching should not be delayed.

Security teams should include Adobe Bridge in endpoint vulnerability scans and software update policies. Prioritize systems used by designers, marketing teams, content teams, and anyone who handles third-party media assets.

Bottom Line

CVE-2026-48449 is the type of vulnerability that deserves fast operational response: maximum CVSS score, potential arbitrary code execution, no user interaction requirement, and impact on an enterprise platform that may hold or access sensitive customer and campaign data. Patch Adobe Campaign Classic, verify exposure, review service account privileges, and check logs for anomalies. Even without known exploitation, the risk profile is high enough to justify immediate action.

Source: The Hacker News report