Overview
Adobe Campaign Classic (ACC) has been found to contain a maximum-severity vulnerability tracked as CVE-2026-48449, carrying the highest possible CVSS score of 10.0 (Critical). The flaw is classified as an Incorrect Authorization vulnerability that results in arbitrary code execution in the context of the current user.
What makes this vulnerability particularly alarming is a combination of factors: it requires no user interaction to exploit, and critically, the scope is changed — meaning a successful exploit can affect systems and components beyond the vulnerable application itself.
Technical Details
The Incorrect Authorization flaw in Adobe Campaign Classic means the application fails to properly validate authorization for certain operations. Key characteristics:
- Attack Vector: Network-accessible
- Attack Complexity: Assessed as low
- Privileges Required: May be limited or none
- User Interaction: None required
- Scope: Changed — the exploit's impact extends beyond ACC itself
- Confidentiality / Integrity / Availability Impact: All assessed as High
The "changed scope" designation is especially significant in enterprise environments where ACC is commonly integrated with marketing automation systems, CRM platforms, email delivery infrastructure, and customer databases. A compromised ACC instance could serve as a foothold into these adjacent systems.
Affected Products
| Product | Status |
|---|---|
| Adobe Campaign Classic (ACC) | Affected |
Check Adobe's official security bulletin for specific version ranges and build numbers.
Impact
Exploitation of CVE-2026-48449 could enable attackers to:
- Execute arbitrary code in the context of the ACC service account
- Breach the application boundary and affect connected systems (changed scope)
- Access customer data stored within or accessible from Campaign Classic
- Disrupt marketing operations and email campaign delivery
- Compromise CRM integrations and downstream data pipelines
For organizations using ACC to process personal data under GDPR or similar frameworks, a successful exploit could trigger mandatory breach notification requirements.
Remediation
- Apply Adobe's security patch immediately — monitor Adobe's Security Bulletin page for the official patch
- Restrict network access to ACC servers to trusted IP ranges while patches are being tested and deployed
- Audit service account permissions used by ACC — apply least privilege principles
- Review ACC audit logs for unexpected code execution or unauthorized access
- Notify your Adobe account representative and check for vendor-specific guidance
Detection
Security operations teams should monitor for:
- Unexpected outbound network connections from ACC servers
- Process execution anomalies under the ACC service account
- Unauthorized modifications to campaign templates or system configurations
- Unusual database queries or data exports from ACC-connected databases