Maximum-Severity Flaw in Adobe Campaign Classic Enables Unauthenticated RCE (CVE-2026-48449)
Executive Summary
On August 1, 2026, Adobe released an emergency security advisory addressing a maximum-severity security flaw in Adobe Campaign Classic (ACC), its enterprise marketing automation platform. Tracked as CVE-2026-48449, the vulnerability carries a maximum CVSS v3 score of 10.0.
The flaw stems from incorrect authorization enforcement, allowing unauthenticated remote attackers to execute arbitrary code on vulnerable servers without requiring any user interaction. Adobe simultaneously patched a second high-severity SQL injection vulnerability (CVE-2026-48448, CVSS 8.6), which allows arbitrary file reading and database exfiltration.
Vulnerability ID
Impact Type
Severity
CVSS Score
CVE-2026-48449
Unauthenticated Remote Code Execution (RCE)
Critical
10.0
CVE-2026-48448
SQL Injection & Arbitrary File Read
High
8.6
Deep-Dive Technical Analysis
Adobe Campaign Classic is an enterprise-grade platform widely deployed by global corporations to manage multi-channel marketing campaigns and customer communications.
Root Cause & Vulnerability Mechanism
* CVE-2026-48449 (Authorization Bypass to RCE): The vulnerability exists in ACC's HTTP application server endpoints handling external workflow webhooks and tracking services. An architectural flaw in the access control module fails to evaluate session authentication tokens for specific incoming API requests. Unauthenticated remote attackers can send crafted HTTP payloads to trigger server-side script execution or command injection in the context of the underlying system user.
* CVE-2026-48448 (SQL Injection & File Read): A secondary flaw located within backend campaign report filtering parameters allows SQL injection. Attackers can leverage database file-system functions (such as LOAD_FILE() or pg_read_file()) to read local configuration files, database credentials, and system hashes.
* Exploit Chaining Potential: An attacker can chain CVE-2026-48448 to exfiltrate database keys and local system hashes, then leverage CVE-2026-48449 to achieve reliable, persistent remote code execution across entire corporate marketing stacks.
Industry Impact & Recommendations / Mitigations
Affected Versions
The following deployments are confirmed as vulnerable to these exploits:
* Adobe Campaign Classic v7 versions prior to v7.4.3 (build 9398) on both Windows and Linux operating systems.
Remediation Action Plan
To secure enterprise environments, administrators should follow this remediation roadmap:
1. Emergency Update: Immediately upgrade Adobe Campaign Classic to v7.4.3 build 9398 or later on both Windows and Linux deployments.
2. Network Segmentation: Restrict public internet access to ACC management consoles and workflow endpoints, placing them behind authenticated Zero-Trust Network Access (ZTNA) or VPN perimeters.
3. Database Security Hardening: Audit database service account permissions utilized by Adobe Campaign Classic, ensuring database users lack file-system read/write privileges.
4. Endpoint Monitoring: Monitor ACC application server hosts for unusual child processes spawned by web server daemons (e.g., cmd.exe, powershell.exe, /bin/sh).
Security Review Conducted By: Person
Date of Last Audit: Date