Adobe Patches Eight Critical Campaign Classic Flaws and Connect Code Injection

Adobe released security updates addressing 12 vulnerabilities across Campaign Classic, Connect Desktop and Mobile, Substance 3D Painter, and Creative Cloud Desktop Application. Italy’s CSIRT classified nine flaws as critical and two as high severity, with one severity unspecified. Eight critical vulnerabilities affect Campaign Classic ACC v7 version 7.4.4 build 9402 and earlier on Windows and Linux, potentially allowing arbitrary code execution, security feature bypass, and privilege escalation. Their reported CVSS scores range from 9.1 to 9.9.

Organizations running affected Campaign Classic deployments should upgrade to version 7.4.4 build 9403, as directed in Adobe bulletin APSB26-162, which assigns the update priority 2. Adobe also fixed CVE-2026-48360, a critical code injection vulnerability in Connect Desktop and Mobile that could allow arbitrary code execution; administrators should apply the applicable updates under APSB26-182 and consult Adobe’s bulletins for the other affected products. Adobe reported no known exploitation in the wild for the addressed vulnerabilities.