Adobe Campaign Classic Flaws Enable Critical Remote Code Execution

Adobe released security updates for Campaign Classic, Content Credentials Rust SDK and C2PA Tool, Illustrator, XD, and Substance 3D Designer, Painter, and Sampler. The most severe defects are three critical remote-code-execution vulnerabilities in Campaign Classic, rated CVSS 10.0, that could allow an attacker to take full control of an affected system.

Organizations should urgently update Campaign Classic 7.4.4 build 9400 and earlier to build 9401 and apply Adobe’s available fixes for the other affected products, including Substance 3D Designer 16.0.5 and Content Credentials Rust SDK c2pa-v0.90.11 / C2PA Tool c2patool-v0.27.11. Adobe had not observed exploitation at publication, but the Canadian Centre for Cyber Security advised administrators to review Adobe guidance and deploy the updates promptly.