Critical Security Flaw in Adobe Campaign Classic
CVSS 10.0 vulnerability allows code execution without user interaction.
1Critical Vulnerability Discovery
Adobe has identified a maximum-severity security flaw in its enterprise marketing automation platform Campaign Classic (ACC). Tracked as CVE-2026-48449, this vulnerability scores 10.0 on the CVSS scale. The flaw stems from incorrect authorization that could allow arbitrary code execution in the current user's context without requiring any user interaction, posing significant risks to enterprise systems.
2Secondary High-Risk Vulnerability
The update also addresses another high-severity flaw (CVE-2026-48448, CVSS score: 8.6) related to SQL injection that could enable arbitrary file reads. Adobe's advisory states this update resolves both arbitrary code execution and file system read vulnerabilities. The company confirmed there's no evidence of active exploitation in the wild for either vulnerability at this time.
3Patch Release Details
Both security flaws have been fixed in ACC v7 version 7.4.3 build 9398 for Windows and Linux platforms. Adobe also released updates addressing eight critical vulnerabilities in Adobe Bridge that could lead to privilege escalation and arbitrary code execution. Security researchers Kieran (kaiksi) and yjdfy were credited for discovering and reporting these vulnerabilities through responsible disclosure channels.
4Security Advisory
Adobe strongly recommends users apply these updates immediately to protect their systems. Enterprise users running marketing automation platforms should prioritize these patches, as high-severity vulnerabilities in such systems often become prime targets for cyber attackers. The company emphasized the importance of keeping enterprise marketing systems updated to prevent potential data breaches and operational disruptions.
5Understanding CVSS 10.0
A CVSS (Common Vulnerability Scoring System) score of 10.0 represents the highest severity rating, indicating vulnerabilities that are typically remotely exploitable, require no user interaction, and can provide complete system control. In enterprise systems like Adobe Campaign Classic, such flaws could compromise entire marketing operations and sensitive customer data.
6SQL Injection Risks
The secondary SQL injection vulnerability poses serious threats to database security. Such flaws could allow attackers to access, modify, or delete sensitive customer data. Protecting personal data stored in marketing automation systems is particularly crucial for compliance with data protection regulations like GDPR, making timely patching essential for legal and reputational reasons.
7Security Researchers' Contribution
Adobe acknowledged the critical role of security researchers in identifying these vulnerabilities. Researchers like Kieran (kaiksi) and yjdfy discovered and reported five separate critical flaws. This collaboration highlights the importance of responsible disclosure programs that allow companies to fix vulnerabilities before they become public knowledge and exploited by malicious actors.
8Enterprise Impact Assessment
These vulnerabilities present significant risks for organizations running large-scale marketing operations. Immediate patching is crucial for Campaign Classic users to prevent potential data breaches and associated financial/reputational damages. Security experts recommend all organizations using similar marketing automation platforms review their systems and apply relevant security updates promptly.
Original article: The Hacker News — Adobe Campaign Classic'te Kritik Güvenlik Açığı