Loading story…
Adobe released security updates for Campaign Classic, Content Credentials Rust SDK and C2PA Tool, Illustrator, XD, and Substance 3D Designer, Painter, and Sampler. The most severe defects are three critical remote-code-execution vulnerabilities in Campaign Classic, rated CVSS 10.0, that could allow an attacker to take full control of an affected system.
Organizations should urgently update Campaign Classic 7.4.4 build 9400 and earlier to build 9401 and apply Adobe’s available fixes for the other affected products, including Substance 3D Designer 16.0.5 and Content Credentials Rust SDK c2pa-v0.90.11 / C2PA Tool c2patool-v0.27.11. Adobe had not observed exploitation at publication, but the Canadian Centre for Cyber Security advised administrators to review Adobe guidance and deploy the updates promptly.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-848, directing users and administrators to review Adobe guidance and apply available updates for the affected products.
Adobe reported vulnerabilities affecting Campaign Classic, Substance 3D Designer, Painter and Sampler, Adobe XD, C2PA Tool, Content Credentials Rust SDK, and Illustrator. Affected Campaign Classic releases included ACC v7.4.4 build 9400 and earlier.
Adobe released security updates, including Campaign Classic ACC v7.4.4 build 9401, to address three CVSS 10.0 remote-code-execution flaws (CVE-2026-76193, CVE-2026-76195, and CVE-2026-76197). Adobe also issued updates for affected Content Credentials SDK, Illustrator, Substance 3D, and XD products and said it had not observed exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcecybersecuritynews.com
Open sourcethreataft.com
Open sourcetenable.com
Open sourcecyber.gc.ca
Open sourceheise.de
Open sourcesecurityonline.info
Open sourcecirt.gy
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe released security bulletin **APSB26-120** to fix multiple critical vulnerabilities in **Adobe Campaign Classic v7** affecting **7.4.3 build 9398 and earlier** on Windows and Linux, and urged customers to upgrade to **build 9399**. The patched issues include **CVE-2026-48323** (template engine injection), **CVE-2026-48330** and **CVE-2026-48326** (SQL injection), **CVE-2026-48317** (eval injection), **CVE-2026-48331** (server-side request forgery), and **CVE-2026-48333** (incorrect authorization), with several flaws enabling **arbitrary code execution** or **privilege escalation**. Adobe said the most severe bugs, including **CVE-2026-48331**, **CVE-2026-48323**, and **CVE-2026-48330**, are rated **CVSS 10.0** and can be exploited remotely without authentication or user interaction. Adobe said it is **not aware of in-the-wild exploitation**, but warned that **internet-facing and externally accessible deployments** should be remediated quickly. The bulletin applies to **on-premise and hybrid deployments**, while **Adobe-hosted instances** were already remediated by Adobe. The **Canadian Centre for Cyber Security** separately issued advisory **AV26-776**, directing administrators to review Adobe’s bulletins and apply updates for affected products, including Adobe Campaign Classic.
Aug 5, 2026
Adobe disclosed **`CVE-2026-48449`**, a critical incorrect authorization flaw in **Adobe Campaign Classic v7** that can lead to **remote code execution**, with a **CVSS score of 10.0**. The vulnerability affects **build 9397 and earlier** on **Windows and Linux**, and Adobe addressed the issue in **build 9398**. Adobe-hosted instances were reported as already remediated, while **customer-managed and on-premises deployments** remain exposed until patched. Public reporting and CERT advisories in Paraguay highlighted the severity of the issue and urged organizations using Adobe Campaign Classic to update affected systems. Available information did not identify the exact vulnerable endpoint, component, or exploit chain, and there were **no credible public proof-of-concept details or confirmed in-the-wild exploitation** in the cited reporting. Defenders were advised to prioritize patching internet-exposed instances, restrict network access during remediation, and monitor host and log telemetry for suspicious behavior.
Aug 8, 2026
Adobe Campaign Classic is affected by **CVE-2026-48449**, a critical `CWE-863` incorrect authorization flaw that allows unauthenticated remote attackers to execute arbitrary code in the context of the current user without user interaction. The vulnerability carries a **CVSS 3.1 score of 10.0** with vector `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, indicating full compromise potential across confidentiality, integrity, and availability. Affected versions include Adobe Campaign Classic up to and including **7.4.3 build 9397**, while **7.4.3 build 9398** is listed as unaffected. Adobe has released a security update to address the issue, and public reporting said no active exploitation had been confirmed at publication time. The risk is especially significant for on-premises deployments because a successful compromise could expose **PII, customer databases, email infrastructure, and connected CRM platforms** such as Salesforce and SAP. Organizations are being urged to apply the latest Adobe update immediately, reduce network exposure if patching is delayed, monitor for suspicious Adobe Campaign Classic activity, and review or rotate credentials stored in the platform if compromise is suspected.
Aug 3, 2026