CRITICAL: Adobe Campaign Classic CVE-2026-48449 Rated CVSS 10.0 RCE

Adobe does not hand out perfect CVSS scores as party favors. A 10.0 means every dial on the scoring calculator got turned to the worst available setting, and that is precisely what happened on July 29 when Adobe shipped APSB26-114 for Campaign Classic. The bug is tracked as CVE-2026-48449, it carries a CVSS 3.1 base score of 10.0, and it hands an unauthenticated attacker arbitrary code execution on the box. No credentials, no phishing lure, no waiting around for a marketing manager to open the wrong attachment.

If you run Campaign Classic on your own hardware, this is a drop everything and patch it now situation. Adobe rated the advisory Priority 1, which in Adobe's own language means the product has historically been an attacker target and administrators should apply the fix within roughly 72 hours. That clock started Wednesday.

What Campaign Classic actually is

Adobe Campaign Classic is the on-premise workhorse of Adobe's marketing automation stack. It builds customer segments, schedules email and SMS blasts, tracks who opened what, and generally sits on top of a database full of exactly the sort of information a criminal would like to have. Names, email addresses, phone numbers, purchase history, behavioral profiles, and in regulated industries a good deal more than that. It also has legitimate reasons to send mail from a domain that customers already trust, which makes a compromised instance useful for something well beyond a simple smash and grab.

That combination is what elevates this above a routine patch cycle item. An attacker who lands code execution on a Campaign server gets the customer database and a trusted sending platform in a single motion. Phishing launched from a legitimate marketing server, signed with the victim's own DKIM keys and passing the victim's own SPF records, is a materially different threat than the usual lookalike domain nonsense that most filters catch on reputation alone.

The technical picture

CVE-2026-48449 is classified as CWE-863, incorrect authorization. That is the polite way of saying the application checks whether you are allowed to do something and reaches the wrong conclusion. The published CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and it is worth walking through because the letters explain the number.

Attack vector is network, so the attacker needs nothing beyond reachability. Attack complexity is low, meaning there are no race conditions to win, no memory to groom, no unusual configuration required on the target. Privileges required is none, so there is no authenticated foothold to obtain first. User interaction is none, which rules out every defense that depends on training people not to click things. The three impact metrics are all high, which is full loss of confidentiality, integrity, and availability.

The metric that pushes this from a 9.8 to a clean 10.0 is scope changed. Scope change means the vulnerable component can affect resources beyond its own security authority. In practice the blast radius does not stop at the Campaign application. It reaches the underlying host, the adjacent services, and whatever else that server is permitted to talk to. Anyone who has watched a marketing server sit in the same flat network segment as the CRM and the finance file shares understands immediately why that matters.

Adobe describes the outcome as arbitrary code execution in the context of the current user, which is the standard phrasing and slightly undersells the situation. The question that actually determines your exposure is what account the Campaign services run under, and in a great many real deployments the honest answer is considerably more privileged than anyone intended back when the system went in five years ago and nobody has looked since.

Riding along in the same advisory is CVE-2026-48448, a SQL injection issue scored at 8.6 that leads to arbitrary file system reads. On a quieter day that would be the headline. An attacker who can read arbitrary files off a marketing server walks away with configuration files, connection strings, and stored credentials. Chained ahead of the authorization bug, or used as a fallback if the first one gets blocked by something, the pair is considerably nastier than either half. Adobe credited researchers working under the handles kaiksi and yjdfy for the reports.

Who is exposed

The affected build is Adobe Campaign Classic v7 at 7.4.3 build 9397 and earlier, on both Windows and Linux. The fix is 7.4.3 build 9398, available for both platforms.

Exposure is limited to on-premise deployments, which covers fully self-hosted installations along with the on-premise components of hybrid environments. Adobe has confirmed that its own hosted and managed instances were already remediated, so customers sitting entirely on Adobe managed cloud infrastructure are covered without lifting a finger. Everyone else owns the patching.

That distinction matters more than it first appears, because organizations running hybrid Campaign deployments frequently assume the vendor handles patching across the entire footprint. They do not. If any part of your Campaign estate runs on hardware you control, that part is yours to fix, and the hybrid customers are exactly the population most likely to discover this fact late.

This is also not Campaign Classic's first visit to the top of the scoreboard this summer. Adobe patched CVE-2026-48286 earlier in July, another incorrect authorization flaw scored at 10.0, resolved in build 9397. The build that fixed that one is the build that is vulnerable to this one. Two maximum severity authorization failures in the same component within a few weeks suggests either a very productive researcher pass over the codebase or a systemic weakness in how the application makes access decisions. Either way the practical read for defenders is identical. Assume more is coming, and make sure this system lives somewhere on the network where the next one will not be immediately reachable.

There is one piece of genuinely good news. Adobe stated it is not aware of any exploitation in the wild as of publication. That is a snapshot rather than a guarantee, and it arrives with an obvious caveat attached. Patch diffing a Priority 1 fix for a maximum severity authorization bypass is not a research project that consumes weeks. For this class of flaw the gap between public advisory and working exploit has historically been measured in days, and the advisory has been public since Wednesday.

What to do about it

Update to 7.4.3 build 9398. That is the entire fix, and Adobe has published no partial workaround, which tells you something useful about the nature of the underlying issue.

While the change window gets scheduled, the compensating control that actually helps is reducing network exposure. Campaign Classic administrative and application interfaces have no business being reachable from the public internet, and yet internet facing marketing infrastructure remains a recurring finding in external assessments. Put it behind a VPN or an authenticated reverse proxy, restrict source addresses to known administrative ranges, and then confirm the restriction from an outside vantage point rather than trusting the firewall rule as written. Rules that read correctly and rules that behave correctly are not always the same rules.

For detection, start with the web server and application logs on the Campaign host and hunt for unusual requests to administrative endpoints from addresses outside your normal operator set, paying particular attention to requests that succeed with no preceding authentication event. Because this is an authorization failure rather than a memory corruption bug, exploitation tends to look like well formed and perfectly valid traffic rather than obvious garbage, so anomalous access patterns matter far more here than malformed payload signatures. On the host side, watch for the Campaign service account spawning shells, scripting interpreters, or network utilities, since a marketing application has no legitimate reason to launch a command interpreter. Outbound connections from the Campaign server to anything that is not your mail relay or database host deserve the same scrutiny.

If the server has been reachable from untrusted networks while running a build older than 9398, treat patching as the beginning of the work rather than the end of it. Review the account inventory inside Campaign for additions nobody can account for, check for scheduled workflows or delivery templates that no one remembers creating, and rotate the database credentials along with any API keys stored on that host. The file read bug means secrets on that machine should be considered exposed until you can prove otherwise, and proving otherwise usually requires logs that most organizations discover they were not keeping.

The MSP angle

A maximum severity flaw in a system that holds the client's entire customer database is the cleanest possible argument for external attack surface monitoring as a recurring service, because the sales conversation writes itself the moment you can show a client their own marketing server answering from the open internet. Bundle a quarterly external exposure review with emergency patch response into a managed offering and this advisory becomes the case study that closes it. There is also a natural upsell into network segmentation work for any client whose scope changed blast radius runs straight into the CRM, since a flat network is what turns a single application vulnerability into an enterprise wide incident.