Loading story…
Adobe released security bulletin APSB26-120 to fix multiple critical vulnerabilities in Adobe Campaign Classic v7 affecting 7.4.3 build 9398 and earlier on Windows and Linux, and urged customers to upgrade to build 9399. The patched issues include CVE-2026-48323 (template engine injection), CVE-2026-48330 and CVE-2026-48326 (SQL injection), CVE-2026-48317 (eval injection), CVE-2026-48331 (server-side request forgery), and CVE-2026-48333 (incorrect authorization), with several flaws enabling arbitrary code execution or privilege escalation. Adobe said the most severe bugs, including CVE-2026-48331, CVE-2026-48323, and CVE-2026-48330, are rated CVSS 10.0 and can be exploited remotely without authentication or user interaction.
Adobe said it is not aware of in-the-wild exploitation, but warned that internet-facing and externally accessible deployments should be remediated quickly. The bulletin applies to on-premise and hybrid deployments, while Adobe-hosted instances were already remediated by Adobe. The Canadian Centre for Cyber Security separately issued advisory AV26-776, directing administrators to review Adobe’s bulletins and apply updates for affected products, including Adobe Campaign Classic.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-776 warning that Adobe products, including Adobe Campaign Classic, were affected by vulnerabilities as of August 3, 2026. The notice directed users and administrators to review Adobe bulletins and apply updates.
Adobe published security bulletin APSB26-120 and issued a critical security update for Adobe Campaign Classic on Windows and Linux. The bulletin covers multiple flaws affecting build 9398 and earlier, recommends upgrading to build 9399, and states Adobe is not aware of in-the-wild exploitation.
Several Adobe Campaign Classic vulnerabilities, including CVE-2026-48323, CVE-2026-48326, CVE-2026-48331, CVE-2026-48333, and CVE-2026-48317, were recorded as received by psirt@adobe.com. The issues include template engine injection, SQL injection, SSRF, incorrect authorization, and eval injection flaws affecting ACC v7 through 7.4.3 build 9398.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
10 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe Campaign Classic is affected by **CVE-2026-48449**, a critical `CWE-863` incorrect authorization flaw that allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without user interaction. The vulnerability carries a **CVSS 3.1 score of 10.0** with vector `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, indicating full compromise potential across confidentiality, integrity, and availability. Affected versions include Adobe Campaign Classic up to and including **7.4.3 build 9397**, while **7.4.3 build 9398** is listed as unaffected. Adobe has released a security update to address the issue, and public reporting said no active exploitation had been confirmed at publication time. The risk is especially significant for on-premises deployments because a successful compromise could expose **PII, customer databases, email infrastructure, and connected CRM platforms** such as Salesforce and SAP. Organizations are being urged to apply the latest Adobe update immediately, reduce network exposure if patching is delayed, monitor for suspicious Adobe Campaign Classic activity, and review or rotate credentials stored in the platform if compromise is suspected.
Aug 3, 2026
Adobe disclosed **`CVE-2026-48449`**, a critical incorrect authorization flaw in **Adobe Campaign Classic v7** that can lead to **remote code execution**, with a **CVSS score of 10.0**. The vulnerability affects **build 9397 and earlier** on **Windows and Linux**, and Adobe addressed the issue in **build 9398**. Adobe-hosted instances were reported as already remediated, while **customer-managed and on-premises deployments** remain exposed until patched. Public reporting and CERT advisories in Paraguay highlighted the severity of the issue and urged organizations using Adobe Campaign Classic to update affected systems. Available information did not identify the exact vulnerable endpoint, component, or exploit chain, and there were **no credible public proof-of-concept details or confirmed in-the-wild exploitation** in the cited reporting. Defenders were advised to prioritize patching internet-exposed instances, restrict network access during remediation, and monitor host and log telemetry for suspicious behavior.
Aug 8, 2026
Adobe released security updates for **Campaign Classic**, Content Credentials Rust SDK and C2PA Tool, Illustrator, XD, and Substance 3D Designer, Painter, and Sampler. The most severe defects are three critical remote-code-execution vulnerabilities in Campaign Classic, rated **CVSS 10.0**, that could allow an attacker to take full control of an affected system. Organizations should urgently update Campaign Classic 7.4.4 build 9400 and earlier to build 9401 and apply Adobe’s available fixes for the other affected products, including Substance 3D Designer 16.0.5 and Content Credentials Rust SDK `c2pa-v0.90.11` / C2PA Tool `c2patool-v0.27.11`. Adobe had not observed exploitation at publication, but the Canadian Centre for Cyber Security advised administrators to review Adobe guidance and deploy the updates promptly.
Aug 28, 2026