CVE-2026-48449: Inside Adobe Campaign Classic’s Second Maximum-Severity RCE Flaw in Just One Month
In under a month, Adobe Campaign Classic was hit by two separate maximum-severity vulnerabilities, both scoring a perfect 10.0 on the CVSS scale, and both allowing remote code execution without any login required. That kind of repetition isn’t just a headline statistic — it’s a signal worth pausing on for any technical team running Adobe’s enterprise platforms. This article breaks down what actually happened, why it matters even if Campaign Classic isn’t part of your stack, and what practical steps to take right now.
Table of Contents
- What Did Adobe Actually Disclose?
- How Do the Two Flaws Work Together?
- Who Is Actually Affected?
- Not the First Time: The Similar June Flaw
- Why Does This Bug Class Keep Recurring in Campaign Classic?
- Practical Steps to Check and Protect Your Systems
- The Bigger Lesson for Security Teams
- Conclusion
What Did Adobe Actually Disclose?
At the end of July 2026, Adobe published a security bulletin, APSB26-114, covering two flaws in Campaign Classic. The first, CVE-2026-48449, is classified as an Incorrect Authorization issue and received the highest possible CVSS score: a flat 10.0 out of 10.
That top-tier rating isn’t marketing exaggeration. Based on the official vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the flaw can be exploited directly over the network, with low attack complexity, no privileges required, and no user interaction whatsoever — with full impact on confidentiality, integrity, and availability.
What “Scope: Changed” Actually Means Here
One notable technical detail in this rating is the “Scope: Changed” designation. In practice, this means an attacker’s impact isn’t confined to the component where the flaw was exploited — it can extend into other connected parts of the system. In simpler terms: a single entry point can turn into a full foothold across the server environment.
How Do the Two Flaws Work Together?
Alongside CVE-2026-48449, the same update addressed a second issue, CVE-2026-48448, which falls under the SQL injection category, rated 8.6 on CVSS. This class of vulnerability is well known for exposing data that was never meant to be publicly accessible, such as stored credentials or sensitive configuration files.
The real danger here isn’t either flaw in isolation — it’s the possibility of chaining them into a single attack sequence. An attacker could first use the SQL injection bug to map out the system or extract credentials, then leverage the authorization flaw to execute commands directly on the server. The end result could be near-total control over the affected Campaign Classic environment.
Why Treat Both as a Single Fix, Not Two Separate Tickets
Since both vulnerabilities were resolved in the exact same update, there’s no technical justification for patching one while deferring the other. A single upgrade closes both doors at once, while leaving either one unpatched keeps the combined attack path wide open.
Who Is Actually Affected?
It’s important to draw a clear line between two categories of Adobe Campaign Classic customers:
- On-premise and hybrid deployments: This is the group actually at risk — specifically ACC v7 at build 9397 or any earlier build, on both Windows and Linux.
- Fully cloud-hosted environments managed by Adobe: The company has stated it already secured these environments on its end, with no additional action required from the customer in this case.
This distinction matters because it explains why not everyone using “Adobe Campaign Classic” should assume they’re exposed — nor should everyone assume they’re automatically safe. The answer depends entirely on the deployment model in use.
Not the First Time: The Similar June Flaw
What makes this incident more notable is that it isn’t the first of its kind for this exact product in a short window. On June 30, 2026, Adobe issued an earlier update, APSB26-69, addressing CVE-2026-48286 — also an Incorrect Authorization flaw, also rated a full 10.0 on CVSS, and also remotely exploitable without any user interaction.
That earlier update moved customers to build 9397 — which turned out to still carry the newly discovered CVE-2026-48449. In other words, anyone who applied the June patch and considered the matter closed needs to re-check immediately, because build 9397 does not cover this new flaw. The required upgrade now is specifically to build 9398.
Quick Comparison Between the Two Flaws
| Item | June Flaw (CVE-2026-48286) | August Flaw (CVE-2026-48449) |
|---|---|---|
| Type | Incorrect Authorization | Incorrect Authorization |
| CVSS Score | 10.0 | 10.0 |
| Fixed Build | 9397 | 9398 |
| Security Bulletin | APSB26-69 | APSB26-114 |
Why Does This Bug Class Keep Recurring in Campaign Classic?
Seeing the same vulnerability category — Incorrect Authorization — appear twice, at the same maximum severity, in the same product, within a matter of weeks, raises a fair question about how the authorization-checking logic is structured throughout Campaign Classic’s codebase. When two flaws of the same type surface back to back at the highest possible rating, that’s often not a case of one stray line of faulty code. It can point to a deeper pattern in how identity and permission checks are designed across different parts of the system.
This pattern isn’t unique to Adobe. Large, complex enterprise platforms that combine administrative interfaces, APIs, and multiple backend services are historically prone to repeated authorization mistakes, because every new access path requires the same verification logic to be applied consistently. A single oversight at any one point is enough to open a full vulnerability.
Practical Steps to Check and Protect Your Systems
If you’re running an on-premise or hybrid Adobe Campaign Classic environment, here’s a practical sequence for handling the current situation:
1. Confirm Your Deployment Model First
Before anything else, determine whether your environment is fully hosted by Adobe (no action needed) or on-premise/hybrid (immediate upgrade required).
2. Check Your Current Build Number
Log into the ACC console and verify the current build number. Any build older than 9398 is considered exposed to both flaws.
3. Apply the Upgrade to Build 9398
Don’t settle for a partial update — the full upgrade to build 9398 is what closes both vulnerabilities at the same time.
4. Assess Your Internet-Facing Exposure
Since the flaw requires no authentication, remediation priority should rise sharply for servers directly exposed to the public internet, compared with those sitting behind an internal VPN.
5. Review Prior Access Logs
Even though there are no confirmed reports of active exploitation as of this writing, it’s still worth reviewing access logs from before the update for any unusual activity.
The Bigger Lesson for Security Teams
Beyond the specifics of this particular flaw, this incident carries a broader message for any technical team: relying on “we applied last month’s update” is no longer a durable guarantee, especially for products experiencing a high rate of critical vulnerability disclosures. What’s needed is a continuous monitoring approach to the security bulletins of every enterprise product your infrastructure depends on, rather than a purely reactive response after an incident occurs.
This case also highlights the importance of clearly separating security bulletins for related products. It’s easy to conflate ColdFusion and Campaign Classic advisories, since Adobe frequently ships updates for several products on the same day — which increases the chance of overlooking one of them during a quick review.
Conclusion
CVE-2026-48449 in Adobe Campaign Classic, with its maximum 10.0 rating, reveals a recurring pattern of authorization issues in this product within a relatively short span, following a similar flaw back in June. Those genuinely at risk are on-premise and hybrid deployment users at build 9397 or earlier, while Adobe-hosted cloud environments are already secured. The one effective step is an immediate upgrade to build 9398, paired with a review of access logs and an honest assessment of internet exposure. And while Adobe reports no confirmed active exploitation so far, the maximum severity rating makes delaying this patch a hard choice to justify.
Want Critical Vulnerability Updates as Soon as They Drop?
Subscribe to the GEANTECHNOLOGY security newsletter to get alerts on critical vulnerabilities and cybersecurity updates delivered straight to your inbox the moment they’re published.
FAQ
Does this vulnerability affect the cloud-hosted version of Adobe Campaign Classic? No. Adobe has stated it already secured fully cloud-hosted environments on its end, and no additional action is required from the customer in that case.
What’s the difference between the June flaw and the August flaw? Both are Incorrect Authorization issues rated a full 10.0 on CVSS, but the June flaw (CVE-2026-48286) was resolved by upgrading to build 9397, while the August flaw (CVE-2026-48449) requires upgrading specifically to build 9398 — even if you already applied the June update.
Want more hands-on Linux guides like this?
Subscribe to the GEANTECHNOLOGY newsletter for weekly tutorials on networking, cybersecurity, and server administration — or take the next step and secure your infrastructure further.