Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution.
Intelligence analysis by Llama
Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system.
Imagine you have a super powerful tool that can do anything you want, but it's not supposed to be used without permission. If someone finds a way to make the tool do what they want without needing permission, that's a big problem. Adobe has a tool called Campaign Classic that can do a lot of things, but it's not supposed to be used without permission. Someone found a way to make it do what they want without needing permission, so Adobe fixed it.
Analysis
A Critical Flaw in Adobe Campaign Classic
Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system.
The update also resolves another high-severity flaw (CVE-2026-48448, CVSS score: 8.6) stemming from SQL injection that could pave the way for arbitrary file reads. "This update addresses critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read," Adobe said in an advisory. The company noted that it's not aware of any of the flaws being exploited in the wild. Both shortcomings have been addressed in ACC v7: 7.4.3 build 9398 for Windows and Linux.
Separately, Adobe Fixes Eight Critical Flaws in Adobe Bridge
Adobe has also shipped updates to remediate eight critical-rated flaws in Adobe Bridge that could lead to privilege escalation and arbitrary code execution - CVE-2026-48395 (CVSS score: 8.6), CVE-2026-48396 (CVSS score: 8.6), CVE-2026-48390 (CVSS score: 8.6), CVE-2026-48391 (CVSS score: 8.2), CVE-2026-48374 (CVSS score: 7.8), CVE-2026-48392 (CVSS score: 7.8), CVE-2026-48393 (CVSS score: 7.8), and CVE-2026-48394 (CVSS score: 7.8).
Credit and Recommendations
Adobe credited security researcher Kieran ("kaiksi") with discovering and reporting CVE-2026-48390, CVE-2026-48391, CVE-2026-48395, CVE-2026-48396, and CVE-2026-48374, and "yjdfy" for CVE-2026-48392, CVE-2026-48393, and CVE-2026-48394. Users are advised to apply the latest updates for optimal protection.
Key points
- Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC) that could result in arbitrary code execution.
- The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system.
- The update also resolves another high-severity flaw (CVE-2026-48448, CVSS score: 8.6) stemming from SQL injection that could pave the way for arbitrary file reads.
- Adobe has also shipped updates to remediate eight critical-rated flaws in Adobe Bridge that could lead to privilege escalation and arbitrary code execution.
If the update is applied successfully, the risk of arbitrary code execution and arbitrary file system read will be mitigated, and users will be protected from potential attacks.
If the update is not applied in a timely manner, the risk of arbitrary code execution and arbitrary file system read will remain, and users may be vulnerable to potential attacks.
