← News
/DISPATCH · 2026-08-03

CVE-2026-48449: Adobe Campaign Classic Unauthenticated RCE Advisory, CVSS 10.0

Adobe published APSB26-114 on 29 Jul 2026, patching CVE-2026-48449 in Adobe Campaign Classic (ACC), a CVSS v3.1 10.0 incorrect-authorization flaw. Unauthenticated attackers can RCE with no user interaction. All 7.4.3 build 9397 and earlier are affected; upgrade to 7.4.3 build 9398 immediately.

On 29 Jul 2026, Adobe published security bulletin APSB26-114, disclosing a critical incorrect-authorization flaw in the enterprise marketing automation platform Adobe Campaign Classic (ACC), tracked as CVE-2026-48449, CVSS v3.1 10.0 (Critical). Unauthenticated remote attackers can execute arbitrary code in the current-user context with no user interaction. Scope is Changed, so impact can spill from the vulnerable component into other privilege domains. Adobe reports no in-the-wild exploitation at disclosure; given the zero-interaction, zero-credential profile, weaponization is a matter of time.

Incident overview

Adobe Campaign Classic is the enterprise marketing automation product in Adobe Experience Cloud, used for large-scale campaigns, email, customer-data integration, and CRM connectivity. It sits in critical back offices across finance, telecom, retail, and healthcare. A sister bug disclosed the same day, CVE-2026-48448 (CVSS 8.6, SQL injection), enables arbitrary file read. Chained with CVE-2026-48449 it can fully compromise an ACC instance.

Technical details

Classified as CWE-863 Incorrect Authorization. ACC's application layer fails to authorize callers on API or web endpoint requests, so attackers can bypass access control and hit restricted functions. Vector string:

`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

AV:N = network-remote; AC:L = low complexity; PR:N and UI:N = no privileges, no user interaction; S:C = changed scope, lateral impact on other components. Crafted requests to exposed ACC endpoints bypass the authorization layer and trigger arbitrary code execution in the application context, yielding access to:

Chained with CVE-2026-48448, an attacker can SQL-inject ACC database and application config files, then use 48449 for full control.

Impact

CVSS 10.0 is the maximum: C/I/A all High (H) on every CVSS v3.1 dimension. Default ACC endpoints missing authorization checks mean any traffic that can reach the instance—internal or public—is attackable.

EPSS 30-day exploitation probability is 0.54%. Score is modest, but details are public, complexity is low, and Adobe Campaign Classic is widely deployed among Fortune 500 firms, so the real window is short. SaaS tenants are patched by Adobe; on-prem customers must upgrade themselves.

Remediation

Immediate fix

Temporary mitigation

Hardening

Sources