- Published on
Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
- Authors
- Name
- DeepHorus
Adobe has released critical security updates to patch a maximum-severity vulnerability in Campaign Classic, its marketing automation platform for enterprises. The flaw, tracked as CVE-2026-48449, carries a perfect 10.0 CVSS score and could allow arbitrary code execution. The vulnerability is an incorrect authorization issue that requires no user interaction, making it highly dangerous in targeted attacks.
The update also addresses a second high-severity flaw, CVE-2026-48448, a SQL injection vulnerability with a CVSS score of 8.6. This bug could enable arbitrary file reads on affected systems. Both vulnerabilities have been resolved in Campaign Classic v7, specifically version 7.4.3 build 9398 for Windows and Linux environments.
In addition to Campaign Classic, Adobe shipped patches for eight critical-rated flaws in Adobe Bridge, its media manager application. These vulnerabilities range in severity from 7.8 to 8.6 and include untrusted search path issues, incorrect authorization, path traversal, and out-of-bounds write conditions. Exploitation could lead to privilege escalation and arbitrary code execution.
The most severe Bridge flaw, CVE-2026-48395, is an untrusted search path vulnerability that allows arbitrary code execution with a score of 8.6. Several other issues, such as CVE-2026-48390 and CVE-2026-48391, also enable privilege escalation and code execution via incorrect authorization. The breadth of affected components underscores the complexity of securing creative workflows.
Adobe says it is not aware of any active exploitation of these vulnerabilities in the wild, which provides a limited window for organizations to patch. The company credited security researcher Kieran, also known as "kaiksi," for discovering five of the Bridge flaws. Another researcher, "yjdfy," was recognized for reporting three out-of-bounds write vulnerabilities.
The implications are significant for enterprises that rely on Campaign Classic for marketing automation. A successful attack could let an attacker run malicious code in the context of the current user, potentially accessing sensitive customer data. With no user interaction required, the attack surface is expanded, making unpatched systems an easy target.
Adobe is urging users to apply the latest updates immediately to ensure optimal protection. Organizations should prioritize patching internet-facing systems and those handling high-value data. Regular vulnerability assessments and monitoring are also recommended to detect any signs of compromise.
