Loading story…
Adobe disclosed CVE-2026-48449, a critical incorrect authorization flaw in Adobe Campaign Classic v7 that can lead to remote code execution, with a CVSS score of 10.0. The vulnerability affects build 9397 and earlier on Windows and Linux, and Adobe addressed the issue in build 9398. Adobe-hosted instances were reported as already remediated, while customer-managed and on-premises deployments remain exposed until patched.
Public reporting and CERT advisories in Paraguay highlighted the severity of the issue and urged organizations using Adobe Campaign Classic to update affected systems. Available information did not identify the exact vulnerable endpoint, component, or exploit chain, and there were no credible public proof-of-concept details or confirmed in-the-wild exploitation in the cited reporting. Defenders were advised to prioritize patching internet-exposed instances, restrict network access during remediation, and monitor host and log telemetry for suspicious behavior.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
As of August 3, 2026, reviewed public sources did not identify a credible proof of concept, exploit module, or confirmed in-the-wild exploitation for CVE-2026-48449. Adobe stated it was not aware of exploits in the wild for the vulnerabilities covered by APSB26-114.
Adobe Campaign Classic v7 build 9397 and earlier on Windows or Linux was disclosed as affected by CVE-2026-48449, a critical incorrect authorization vulnerability that can lead to remote code execution. Adobe assigned the flaw a CVSS score of 10.0 and noted that the same advisory also addressed CVE-2026-48448.
Adobe remediated the critical incorrect authorization vulnerability CVE-2026-48449 in Adobe Campaign Classic v7.4.3 build 9398. Adobe also stated that its hosted Adobe Campaign Classic instances had already been remediated, while customer-managed and on-premises deployments remained in scope for patching.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cert.gov.py
Open sourcesocradar.io
Open sourcecert.gov.py
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe Campaign Classic is affected by **CVE-2026-48449**, a critical `CWE-863` incorrect authorization flaw that allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without user interaction. The vulnerability carries a **CVSS 3.1 score of 10.0** with vector `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, indicating full compromise potential across confidentiality, integrity, and availability. Affected versions include Adobe Campaign Classic up to and including **7.4.3 build 9397**, while **7.4.3 build 9398** is listed as unaffected. Adobe has released a security update to address the issue, and public reporting said no active exploitation had been confirmed at publication time. The risk is especially significant for on-premises deployments because a successful compromise could expose **PII, customer databases, email infrastructure, and connected CRM platforms** such as Salesforce and SAP. Organizations are being urged to apply the latest Adobe update immediately, reduce network exposure if patching is delayed, monitor for suspicious Adobe Campaign Classic activity, and review or rotate credentials stored in the platform if compromise is suspected.
Aug 3, 2026
Adobe released security bulletin **APSB26-120** to fix multiple critical vulnerabilities in **Adobe Campaign Classic v7** affecting **7.4.3 build 9398 and earlier** on Windows and Linux, and urged customers to upgrade to **build 9399**. The patched issues include **CVE-2026-48323** (template engine injection), **CVE-2026-48330** and **CVE-2026-48326** (SQL injection), **CVE-2026-48317** (eval injection), **CVE-2026-48331** (server-side request forgery), and **CVE-2026-48333** (incorrect authorization), with several flaws enabling **arbitrary code execution** or **privilege escalation**. Adobe said the most severe bugs, including **CVE-2026-48331**, **CVE-2026-48323**, and **CVE-2026-48330**, are rated **CVSS 10.0** and can be exploited remotely without authentication or user interaction. Adobe said it is **not aware of in-the-wild exploitation**, but warned that **internet-facing and externally accessible deployments** should be remediated quickly. The bulletin applies to **on-premise and hybrid deployments**, while **Adobe-hosted instances** were already remediated by Adobe. The **Canadian Centre for Cyber Security** separately issued advisory **AV26-776**, directing administrators to review Adobe’s bulletins and apply updates for affected products, including Adobe Campaign Classic.
Aug 5, 2026
Adobe released security updates for **Campaign Classic**, Content Credentials Rust SDK and C2PA Tool, Illustrator, XD, and Substance 3D Designer, Painter, and Sampler. The most severe defects are three critical remote-code-execution vulnerabilities in Campaign Classic, rated **CVSS 10.0**, that could allow an attacker to take full control of an affected system. Organizations should urgently update Campaign Classic 7.4.4 build 9400 and earlier to build 9401 and apply Adobe’s available fixes for the other affected products, including Substance 3D Designer 16.0.5 and Content Credentials Rust SDK `c2pa-v0.90.11` / C2PA Tool `c2patool-v0.27.11`. Adobe had not observed exploitation at publication, but the Canadian Centre for Cyber Security advised administrators to review Adobe guidance and deploy the updates promptly.
Aug 28, 2026