Adobe Campaign Classic Patches Critical RCE, SSRF, SQLi, and Privilege Escalation Flaws

Adobe released security bulletin APSB26-120 to fix multiple critical vulnerabilities in Adobe Campaign Classic v7 affecting 7.4.3 build 9398 and earlier on Windows and Linux, and urged customers to upgrade to build 9399. The patched issues include CVE-2026-48323 (template engine injection), CVE-2026-48330 and CVE-2026-48326 (SQL injection), CVE-2026-48317 (eval injection), CVE-2026-48331 (server-side request forgery), and CVE-2026-48333 (incorrect authorization), with several flaws enabling arbitrary code execution or privilege escalation. Adobe said the most severe bugs, including CVE-2026-48331, CVE-2026-48323, and CVE-2026-48330, are rated CVSS 10.0 and can be exploited remotely without authentication or user interaction.

Adobe said it is not aware of in-the-wild exploitation, but warned that internet-facing and externally accessible deployments should be remediated quickly. The bulletin applies to on-premise and hybrid deployments, while Adobe-hosted instances were already remediated by Adobe. The Canadian Centre for Cyber Security separately issued advisory AV26-776, directing administrators to review Adobe’s bulletins and apply updates for affected products, including Adobe Campaign Classic.