Critical RCE Flaw in Adobe Campaign Classic v7 Requires Immediate Patching

Adobe disclosed CVE-2026-48449, a critical incorrect authorization flaw in Adobe Campaign Classic v7 that can lead to remote code execution, with a CVSS score of 10.0. The vulnerability affects build 9397 and earlier on Windows and Linux, and Adobe addressed the issue in build 9398. Adobe-hosted instances were reported as already remediated, while customer-managed and on-premises deployments remain exposed until patched.

Public reporting and CERT advisories in Paraguay highlighted the severity of the issue and urged organizations using Adobe Campaign Classic to update affected systems. Available information did not identify the exact vulnerable endpoint, component, or exploit chain, and there were no credible public proof-of-concept details or confirmed in-the-wild exploitation in the cited reporting. Defenders were advised to prioritize patching internet-exposed instances, restrict network access during remediation, and monitor host and log telemetry for suspicious behavior.