Loading vulnerability…
Eval Injection RCE in Adobe Campaign Classic
CVE-2026-48317 is an improper neutralization of directives in dynamically evaluated code (eval injection) vulnerability in Adobe Campaign Classic (ACC) v7 through v7.4.3 build 9398. Insufficient handling of directives evaluated as code enables a low-privileged attacker to execute arbitrary code in the context of the current user. The vulnerability is remotely exploitable without user interaction and has a changed scope.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary code execution in the context of the current user. The CVSS v3.1 vector indicates high confidentiality and integrity impact, no availability impact, and a changed scope; compromise may therefore affect a security authority beyond the initially vulnerable component.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting external access to Adobe Campaign Classic, especially for internet-facing and hybrid deployments, and limit access to trusted administrative or application networks only. Minimize the privileges available to authenticated users, monitor for suspicious activity involving remote code execution attempts, and accelerate patch deployment as the primary corrective measure. Specific vendor-provided workaround information is currently not available.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic v7 deployments to v7.4.3 build 9399 or later. Build 9399 is listed as unaffected by CVE-2026-48317.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.