Adobe Campaign Classic — Second CVSS 10.0 Flaw in a Month Allows Code Execution Without User Interaction (CVE-2026-48449)

Publication date: August 1, 2026 Category: Information Security · Vulnerabilities · Enterprise Security

The Patch: CVE-2026-48449 and CVE-2026-48448

On July 29, 2026, Adobe published bulletin APSB26-114, priority rating 1, fixing two critical vulnerabilities in Adobe Campaign Classic (ACC), its on-premise enterprise marketing automation and multi-channel campaign management platform, covering email, SMS, and direct mail communications.

The primary vulnerability, tracked as CVE-2026-48449, is a case of incorrect authorization (CWE-863) carrying the maximum possible CVSS score: 10.0. The full vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — remotely exploitable (AV:N), with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). Impact is rated high across confidentiality, integrity, and availability, with a scope change (S:C). Adobe describes the outcome as arbitrary code execution in the context of the current user.

A second flaw, CVE-2026-48448, is a SQL injection (CWE-89) issue with a CVSS score of 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), enabling arbitrary file system reads without directly compromising integrity or availability.

Both flaws land in the same patch cycle, but represent two distinct attack paths toward the same objective: gaining control over or visibility into a Campaign Classic server without valid credentials.

Both flaws affect ACC v7: 7.4.3 build 9397 and earlier, on both Windows and Linux, and are fixed in build 9398. The bulletin applies exclusively to fully on-premise deployments and the on-premise components of hybrid deployments; Adobe-hosted instances have already been remediated and require no customer action. Adobe stated it is not aware of active exploitation for either flaw at the time of publication.

Adobe Bridge: Eight Additional Critical Flaws

Separately, on July 28, 2026, Adobe published bulletin APSB26-89, remediating eight critical vulnerabilities in Adobe Bridge — the digital asset manager in the Creative Cloud suite — affecting versions 15.1.6 (LTS) and earlier, and 16.0.5 and earlier, on Windows and macOS. Fixed versions are 15.1.7 (LTS) and 16.0.6.

Unlike CVE-2026-48449, all eight Bridge flaws share a local (AV:L) attack vector and require user interaction (UI:R) — typically opening a manipulated file, project, or folder — placing them in a different risk category: they are post-compromise or social-engineering vectors, not remotely exploitable flaws requiring no intervention like those in Campaign Classic.

Adobe credited security researcher Kieran (“kaiksi”) with reporting CVE-2026-48390, CVE-2026-48391, CVE-2026-48395, CVE-2026-48396, and CVE-2026-48374, and “yjdfy” with CVE-2026-48392, CVE-2026-48393, and CVE-2026-48394. Adobe reported no evidence of active exploitation for any of the eight flaws.

The Pattern: Campaign Classic’s Second CVSS 10.0 Incorrect-Authorization Flaw in a Month

CVE-2026-48449 is not the first maximum-severity flaw Adobe has fixed in Campaign Classic in 2026. On June 30, 2026, Adobe published bulletin APSB26-69, fixing CVE-2026-48286 — also an incorrect authorization (CWE-863) vulnerability, also carrying a CVSS score of 10.0, and with an identical CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That flaw affected build 9396 and earlier and was fixed in build 9397 — the very version that turned out to be vulnerable to CVE-2026-48449 a month later.

In practical terms: two distinct vulnerabilities, sharing the same CWE classification, the exact same CVSS vector, and the same outcome — arbitrary code execution requiring no authentication and no user interaction — were fixed in the same on-premise component of Campaign Classic within four weeks of each other. Both bulletins share one additional data point: in neither case did Adobe report evidence of active exploitation at the time of disclosure.

Analysis: AI-Accelerated Vulnerability Discovery and the CVE-2026-48282 Precedent

The June 30, 2026 Campaign Classic bulletin (CVE-2026-48286) did not arrive alone: it was published alongside seven additional CVSS 10.0 vulnerabilities in Adobe ColdFusion, bringing the total to eight maximum-severity flaws disclosed on a single day. That same June 25, 2026, Adobe’s Chief Security Officer, Aanchal Gupta, published a post on the company’s security blog announcing a structural change to Adobe’s disclosure process: effective July 14, 2026, Adobe moved from a monthly to a twice-monthly publication cadence for security bulletins, released on the second and fourth Tuesday of each month.

According to Gupta, the change is a direct consequence of Adobe’s adoption of frontier AI models and agentic analysis tooling to accelerate internal vulnerability discovery at scale. Adobe’s core argument mirrors the one this publication has already documented while analyzing GPT-5.4-Cyber and Claude Mythos: the same AI capabilities a company uses defensively to find flaws faster are, in principle, the same capabilities an attacker can apply to exploit those flaws before a patch reaches production — compressing the window between disclosure and exploitation from days to hours.

That compression is not an abstract projection. The same June 30 patch batch included CVE-2026-48282, a path traversal (CWE-22) vulnerability in Adobe ColdFusion with a CVSS score of 10.0, exploitable through the legacy Remote Development Services (RDS) file handler to write a webshell directly into the web server’s root directory without authentication. According to telemetry reported by researcher Ryan Dewhurst, founder of KEVIntel, his company’s global honeypot network detected active exploitation attempts against CVE-2026-48282 within under two hours of the corresponding technical write-up going public. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on July 7, 2026, invoking Binding Operational Directive BOD 26-04 with a three-day remediation deadline for federal agencies.

The structural pattern mirrors what other articles on this publication have documented in the Cisco SD-WAN ecosystem: the accumulation of maximum-severity flaws in the same component, within increasingly narrow time windows, points to a persistent attack surface in Campaign Classic’s authorization subsystem — not isolated incidents. While Adobe states it has no evidence of active exploitation of CVE-2026-48449 at the time of this publication, the CVE-2026-48282 precedent suggests that grace window should not be assumed to last.

Blue Team Perspective: Detection and Containment

Because CVE-2026-48449 requires no authentication and no user interaction, and because Adobe Campaign Classic manages customer databases, email/SMS integration credentials, and marketing workflows with access to backend systems, the defensive priority combines immediate remediation with detection in case the patch cannot be applied right away.

Deception-Based Detection (Honeypots)

• Decoy ACC instances: for organizations running multiple Campaign Classic environments, deploying a low-interaction instance exposing the same HTTP/HTTPS endpoints as the production instance allows detection of scans specifically targeting ACC’s authorization surface before they reach the real system.
• Honeytokens in campaign databases: fake customer credentials and records within Campaign Classic segmentation tables enable detection of exfiltration if an actor manages to read system files via CVE-2026-48448 or pivots to the database after successful code execution.
• Honeytoken files on the ACC server file system: since CVE-2026-48448 enables arbitrary file reads via SQL injection, placing decoy files in paths typically targeted by these techniques (configuration files, connection credentials for external services) generates high-confidence alerts on any access.

IDS/IPS and Behavior-Based Monitoring

• Monitoring anomalous HTTP requests against ACC authorization endpoints: custom Suricata/Snort rules correlating atypical request sequences against campaign management and authentication endpoints, particularly those bypassing the normal session flow.
• Auditing child processes of the ACC service: since successful exploitation of CVE-2026-48449 results in code execution within the context of the service’s user, any unexpected child process spawned by the Campaign Classic service (command interpreters, download tools, LOLBins) constitutes a high-priority signal.
• Detecting anomalous SQL queries: for CVE-2026-48448, correlate underlying database logs against SQL injection patterns — nested quotation marks, SQL comments, file-read functions depending on the database engine in use.
• Network segmentation and WAF: since both Campaign Classic flaws are remote and require no interaction, restricting access to on-premise instances via access control lists, VPN, or WAF significantly reduces exposed surface while the patch cycle is completed.
• For Adobe Bridge: since its eight flaws require user interaction, the most relevant vector is opening files or project folders from untrusted sources (downloads, attachments, external shared repositories). EDR policies restricting execution of signed binaries from untrusted search paths and monitoring file loading from unexpected system locations mitigate several of these vectors.

Timeline

Remediation Actions in Priority Order

1. Update Adobe Campaign Classic to build 9398 across all on-premise instances and on-premise components of hybrid deployments. Adobe-hosted instances have already been remediated.

2. Audit the perimeter exposure of on-premise ACC instances. Since CVE-2026-48449 requires no authentication and no user interaction, any internet-accessible instance should be treated as immediate risk until the patch is confirmed.

3. Update Adobe Bridge to versions 15.1.7 (LTS) or 16.0.6 via the Creative Cloud update mechanism, prioritizing workstations that process files or projects from external sources.

4. Review access logs and database queries on ACC instances for SQL injection patterns or anomalous file reads correlated with CVE-2026-48448, particularly during the period preceding patch application.

5. Subscribe to Adobe’s security notification service and adjust patch-planning cycles to the new twice-monthly cadence (second and fourth Tuesday of each month), given the exploitation-window compression precedent documented in CVE-2026-48282.

6. Restrict access to on-premise Campaign Classic instances via network segmentation, VPN, or WAF while the patch cycle is completed in environments with extended maintenance windows.

Wrapping Up…

CVE-2026-48449 is the second CVSS 10.0 incorrect-authorization vulnerability Adobe has fixed in Campaign Classic within a month, sharing an identical CVSS vector with CVE-2026-48286, disclosed on June 30, 2026. That repetition, together with the eight additional flaws fixed in Adobe Bridge, comes amid a structural change to Adobe’s disclosure process: the company explicitly attributes its new twice-monthly bulletin cadence to AI-accelerated vulnerability discovery, and warns that the same capability is available to malicious actors.

The most relevant precedent for calibrating the urgency of this fix is CVE-2026-48282, disclosed in the same June bulletin batch: a path traversal flaw in Adobe ColdFusion that went from patch publication to documented active exploitation in under two hours. Although Adobe reports no evidence of exploitation of CVE-2026-48449 at the time of this publication, that absence of evidence should not be read as absence of risk, given the temporal-compression pattern already observed from the same vendor within the same disclosure window.

For security teams operating Campaign Classic on-premise, the central recommendation is not only to apply the build 9398 patch, but to audit whether the instance was exposed to the internet without adequate mitigations during the window between disclosure and effective patch application — and to treat the reported absence of exploitation as a temporary condition, not a guarantee of future safety.

Sources consulted:

• Adobe. “Security update available for Adobe Campaign Classic” — APSB26-114, Adobe Security Bulletin (July 29, 2026)
• Adobe. “Security Updates Available for Adobe Bridge” — APSB26-89, Adobe Security Bulletin (July 28, 2026)
• Adobe. “Security updates available for Adobe Campaign Classic” — APSB26-69, Adobe Security Bulletin (June 30, 2026)
• Gupta, A. “Protecting customers faster: How Adobe is responding to AI-accelerated vulnerability discovery” — Adobe Security Blog (June 25, 2026)
• Lakshmanan, R. “Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction” — The Hacker News (August 1, 2026)
• Lakshmanan, R. “Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic” — The Hacker News (July 1, 2026, updated July 3, 2026)
• Divya. “Critical Adobe Campaign Flaw Lets Attackers Execute Arbitrary Code” — GBHackers (July 31, 2026)
• Paganini, P. “Adobe fixed multiple maximum-severity flaws in ColdFusion and Campaign Classic” — Security Affairs (July 1, 2026)
• CISA. “CISA Adds One Known Exploited Vulnerability to Catalog” — CISA (July 7, 2026)
• “Adobe ColdFusion CVE-2026-48282 — Exploited in 2 Hours” — Tech-Insider.org (2026)