Adobe Fixes Maximum-Severity CVSS 10.0 Flaw in Campaign Classic (CVE-2026-48449)
Executive Summary
Adobe has issued an urgent security release addressing a maximum-severity vulnerability in Adobe Campaign Classic (ACC), tracked as CVE-2026-48449 with a critical CVSS v3.1 base score of 10.0. The flaw stems from an authorization weakness that enables unauthenticated remote attackers to execute arbitrary code on underlying servers without requiring any user interaction or valid credentials (Security Affairs, The Hacker News).
Because Adobe Campaign Classic serves as a central orchestrator for enterprise marketing automation, transactional emails, and multi-channel customer communications, a compromised instance gives threat actors unrestricted control over sensitive customer datasets, campaign delivery channels, and internal enterprise networks. Adobe has also patched a companion high-severity SQL injection flaw (CVE-2026-48448, CVSS score 8.6) in the same update release (Adobe Security Bulletin APSB26-114). All organizations running affected on-premises builds must apply security updates immediately to mitigate potential exploitation risks.
Deep-Dive Technical Analysis
Understanding CVE-2026-48449 (CVSS 10.0)
The primary vulnerability, CVE-2026-48449, is classified under improper access control and authorization enforcement (CWE-285/CWE-863). The vulnerability resides within the application server's endpoint processing routines, where incoming remote requests are handled prior to session validation (Security Affairs).
* Attack Vector: Remote, network-accessible (AV:N). An attacker sends specifically crafted HTTP/SOAP request payloads to vulnerable Campaign Classic server endpoints.
* Exploitation Mechanics: Due to improper authorization checks in specific API request handlers, the application fails to verify whether the requesting user possesses administrative permissions or valid authentication tokens. By bypassing these checks, unauthenticated callers can trigger internal server functions that accept arbitrary command or script inputs.
* Execution Context: Successful exploitation executes code within the context of the current operating system service user running the Campaign Classic server daemon (nlserver). On Linux/Windows enterprise hosts, this context typically holds broad permissions across local databases, file stores, and connected outbound SMTP gateways (The Hacker News).
* Zero User Interaction: The vulnerability carries a UI:N (User Interaction: None) and PR:N (Privileges Required: None) vector rating, meaning automated exploit bots can scan for and compromise exposed management ports without tricking an employee or clicking a link.
Secondary Flaw: CVE-2026-48448 (CVSS 8.6)
In addition to the CVSS 10.0 RCE vulnerability, Adobe addressed CVE-2026-48448, a high-severity SQL injection vulnerability. Unauthenticated or low-privileged actors can inject SQL commands through unvalidated input fields in specific campaign reporting or tracking modules. This allows attackers to bypass database abstraction layers, read arbitrary files from the underlying server filesystem, and exfiltrate database contents (Security Affairs).
Affected Versions
Product
Affected Versions
Platform
Status
Adobe Campaign Classic v7 (ACC)
v7.4.3 build 9397 and earlier
Windows, Linux
Vulnerable
Adobe Campaign Classic v7 (ACC)
v7.4.3 build 9398
Windows, Linux
Patched
Strategic Threat Analysis: Why Marketing Automation Engines Are High-Value Targets
Enterprise marketing automation platforms like Adobe Campaign Classic sit at the intersection of critical business data and external communication channels. Attackers targeting ACC systems gain distinct tactical advantages:
1. Mass Customer Data Exfiltration: Campaign Classic instances store massive volumes of Personally Identifiable Information (PII), customer behavior logs, purchase histories, and contact lists. A breach allows immediate, bulk exfiltration of customer records for extortion or dark web sales.
2. Brand Disruption & Phishing Weaponization: By gaining RCE on a Campaign Classic server, attackers can hijack official email dispatch queues. They can send legitimate, cryptographically signed (DKIM/SPF-aligned) phishing emails or scam campaigns directly to millions of customers from official corporate domains.
3. Lateral Movement & Cloud Pivoting: Campaign Classic servers frequently maintain high-trust database connections to internal CRM systems, customer data platforms (CDP), and enterprise data warehouses. RCE on the campaign host serves as a beachhead for pivoting deeper into internal corporate subnets.
Industry Impact & Actionable Mitigations
While Adobe reports no active zero-day exploitation in the wild at the time of disclosure (Security Affairs), the maximum-severity score guarantees that security researchers and threat actors will attempt to reverse-engineer build 9398 to produce weaponized exploits. Organizations should execute the following mitigation playbook immediately:
1. Upgrade to ACC v7.4.3 Build 9398
System administrators managing on-premises or hybrid deployments of Adobe Campaign Classic must prioritize upgrading all application instances to v7.4.3 build 9398 or later (Adobe Security Bulletin APSB26-114).
2. Isolate Management Interfaces Behind ZTNA / VPN
Adobe Campaign Classic web interfaces (/nl/jsp/soaprouter.jsp and administrative consoles) should never be exposed to the public internet without perimeter access controls. Enforce Zero Trust Network Access (ZTNA) or strict VPN access requirements for all administrative and API endpoints.
3. Audit System Logs and API Call Traces
Inspect web server access logs (Apache/IIS) and nlserver execution logs for anomalous POST requests directed at unauthenticated endpoints. Monitor for uncharacteristic child process spawning from nlserver binaries or unexpected database file-read operations.
References & Citations:
* Security Affairs: Adobe fixed a maximum severity vulnerability in Campaign Classic
* The Hacker News: Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
* Adobe Security Bulletin APSB26-114