Loading story…
Adobe Campaign Classic is affected by CVE-2026-48449, a critical CWE-863 incorrect authorization flaw that allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without user interaction. The vulnerability carries a CVSS 3.1 score of 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating full compromise potential across confidentiality, integrity, and availability. Affected versions include Adobe Campaign Classic up to and including 7.4.3 build 9397, while 7.4.3 build 9398 is listed as unaffected.
Adobe has released a security update to address the issue, and public reporting said no active exploitation had been confirmed at publication time. The risk is especially significant for on-premises deployments because a successful compromise could expose PII, customer databases, email infrastructure, and connected CRM platforms such as Salesforce and SAP. Organizations are being urged to apply the latest Adobe update immediately, reduce network exposure if patching is delayed, monitor for suspicious Adobe Campaign Classic activity, and review or rotate credentials stored in the platform if compromise is suspected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On July 30, 2026, CVE-2026-48449 was recorded as a critical incorrect authorization vulnerability in Adobe Campaign Classic. The flaw can allow unauthenticated remote code execution in the context of the current user without requiring user interaction.
Adobe fixed CVE-2026-48448, a high-severity SQL injection flaw in Adobe Campaign Classic that could enable arbitrary file reads. The issue was remediated in version 7.4.3 build 9398 for Windows and Linux, and Adobe said it was not aware of in-the-wild exploitation.
Adobe released a security update in June 2026 to address CVE-2026-48449 in Adobe Campaign Classic. The issue affects on-premises deployments, with versions up to and including 7.4.3 build 9397 affected and 7.4.3 build 9398 listed as unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcethreataft.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe has released Priority 1 security updates for **ColdFusion** and **Adobe Campaign Classic** to fix multiple high-severity vulnerabilities, including seven flaws rated `CVSS 10.0`. In ColdFusion, the patched issues affect versions `2025.9`, `2023.20`, and earlier, and include improper input validation (`CVE-2026-48281`, `CVE-2026-48277`), unrestricted file upload (`CVE-2026-48276`, `CVE-2026-48283`), and path traversal (`CVE-2026-48282`) bugs that could allow unauthenticated remote code execution without user interaction. Additional ColdFusion flaws include a path traversal issue with arbitrary file read and limited write access (`CVE-2026-48313`), an SSRF bug (`CVE-2026-48285`), and user-interaction issues such as reflected XSS (`CVE-2026-48307`) and improper input validation tied to malicious files (`CVE-2026-48315`). Adobe also patched `CVE-2026-48286` in **Adobe Campaign Classic**, an incorrect authorization flaw affecting version `7.4.3` and earlier that can lead to arbitrary code execution on on-premises instances. Adobe said it is not aware of in-the-wild exploitation of the specific vulnerabilities, but assigned the updates a **Priority 1** rating, indicating they are being targeted or are at high risk of being targeted, and urged administrators to patch within 72 hours. Recommended versions include **ColdFusion 2025 Update 10**, **ColdFusion 2023 Update 21**, and **Campaign Classic 7.4.4 / build 9397 or later**.
Jul 12, 2026
Adobe released a broad set of security updates covering **Adobe Experience Manager**, **Acrobat/Reader**, **ColdFusion**, **Dreamweaver**, **InDesign**, **InCopy**, **Substance 3D Sampler**, **Format Plugins**, **Campaign Classic**, and Content Credentials SDK components, prompting alerts from national and regional CERTs including Canada’s Cyber Centre and HKCERT. The advisories span multiple high-severity issues, with affected versions including **ColdFusion 2023.19 and 2025.8 and earlier**, **Dreamweaver 21.7 and earlier**, **Campaign Classic 7.4.3 build 9394 and earlier**, and **AEM Forms JEE LTS SP1 / 6.5.24.0 and earlier**. The most serious disclosures include multiple **remote code execution** bugs in Acrobat/Reader such as `CVE-2026-47911`, `CVE-2026-47912`, `CVE-2026-47913`, `CVE-2026-47914`, `CVE-2026-47915`, `CVE-2026-47918`, and `CVE-2026-47919`, largely tied to use-after-free conditions and malicious file handling; several **ColdFusion** flaws including `CVE-2026-47928`, `CVE-2026-47929`, `CVE-2026-47930`, `CVE-2026-47931`, and `CVE-2026-47932` that can enable code execution, security feature bypass, or unauthorized read/write access; **AEM Forms JEE** stored and reflected XSS issues `CVE-2026-34691` and `CVE-2026-34693`; **Campaign Classic** issues `CVE-2026-47938` and `CVE-2026-48303` involving SSRF, privilege escalation, and possible code execution; **Dreamweaver** arbitrary file read via `CVE-2026-47907`; and **USD Fileformat Plugins** heap-based buffer overflows `CVE-2026-48291` and `CVE-2026-48292`. Adobe has issued patches for the affected products, and defenders are being urged to review the vendor bulletins and deploy updates quickly.
Jun 29, 2026
Adobe released security advisories addressing multiple vulnerabilities across a range of its products, including ColdFusion, Adobe Experience Manager (AEM), DNG Software Development Kit (SDK), Acrobat, Acrobat Reader, and the Creative Cloud Desktop Application. The most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user, potentially enabling attackers to install programs, modify or delete data, or create new accounts with full user rights. Affected versions span ColdFusion 2025, 2023, and 2021, AEM Cloud Service and 6.5 LTS, DNG SDK 1.7.0 and prior, Acrobat and Acrobat Reader 2020 and 2024 for both Windows and Mac, and Creative Cloud Desktop Application 6.4.0.361 and earlier. Users and administrators are strongly encouraged to review the official advisories and apply the necessary updates to mitigate risk. Threat intelligence at the time of disclosure indicated no reports of these vulnerabilities being exploited in the wild. The advisories emphasize that users with administrative privileges are at greater risk if exploited, and recommend prompt patching to reduce exposure. Organizations relying on Adobe products for document management, web application development, or digital asset workflows should prioritize these updates to prevent potential compromise through remote code execution vulnerabilities.
Jun 29, 2026