Critical security vulnerability patched in Adobe Campaign Classic
Remote code execution flaw fixed in enterprise marketing platform.
1Critical vulnerability discovered
Adobe identified a critical security vulnerability (CVE-2026-48449, CVSS 10.0) in Campaign Classic. The flaw, caused by incorrect authorization, could allow remote code execution without user interaction. Affecting Adobe's enterprise marketing automation platform, this vulnerability posed significant risk. Adobe confirmed no active exploits in the wild but urged immediate patching to prevent potential attacks.
2High-risk SQL injection flaw
Additionally, Adobe addressed CVE-2026-48448, a high-severity SQL injection vulnerability with CVSS 8.6 score enabling arbitrary file reads. Both vulnerabilities were patched in Adobe Campaign Classic v7.4.3 build 9398 for Windows and Linux. The company strongly recommended organizations apply these security updates promptly to mitigate exploitation risks in their marketing automation systems.
3Adobe Bridge vulnerabilities
Adobe also released updates fixing eight critical vulnerabilities in Adobe Bridge. These included flaws like incorrect authorization, untrusted search path, path traversal, and out-of-bounds writes, with CVSS scores ranging 7.8-8.6. Successful exploitation could allow attackers to execute arbitrary code or escalate privileges, making timely updates crucial for enterprise security.
4Technical details of flaws
The patched vulnerabilities covered various categories including CWE-426 (Untrusted Search Path), CWE-863 (Incorrect Authorization), CWE-22 (Path Traversal), and CWE-787 (Out-of-bounds Write). The most severe flaws received CVSS 8.6 scores, classified as Critical. Reported by researchers Kieran (kaiksi) and yjdfy, these vulnerabilities presented diverse attack vectors requiring immediate attention.
5Affected versions and updates
The security flaws impacted specific versions of Adobe Campaign Classic. The v7.4.3 build 9398 update for Windows and Linux addressed all critical issues. Similarly, Adobe Bridge updates resolved comparable vulnerabilities. Enterprise users were advised to implement these patches without delay to maintain robust cybersecurity defenses against evolving threats.
6Researchers' contributions
Security researchers Kieran (kaiksi) and yjdfy played crucial roles in identifying and reporting these vulnerabilities. Such responsible disclosure practices strengthen overall software security. Adobe's security team promptly investigated and developed appropriate patches, demonstrating effective collaboration between vendors and researchers that benefits the entire cybersecurity ecosystem.
7Enterprise risk management
Critical vulnerabilities in marketing automation platforms pose substantial risks for organizations. Attackers could exploit unpatched systems to infiltrate corporate networks or steal sensitive data. IT teams must monitor security bulletins regularly and implement patches promptly to maintain strong security postures against increasingly sophisticated cyber threats.
8Industry-wide implications
These security flaws in Adobe's enterprise solutions underscore the importance of software supply chain security. Vulnerabilities in business-critical applications can have far-reaching consequences across industries. Regular security audits and timely patch management remain essential practices for ensuring the security of digital transformation initiatives in an interconnected business landscape.
Original article: Security Affairs — Adobe Campaign Classic'te kritik güvenlik açığı düzeltildi