Loading vulnerability…
Unauthenticated template injection RCE in Adobe Campaign Classic
CVE-2026-48323 is a template-engine injection vulnerability in Adobe Campaign Classic caused by improper neutralization of special elements in user-supplied template variables or parameters. An unauthenticated attacker with network access can exploit the flaw to execute arbitrary code in the context of the current user without user interaction. Adobe Campaign Classic v7 through version 7.4.3 build 9398 is identified as affected, and version 7.4.3 build 9399 is identified as unaffected. Affected deployments include on-premises and hybrid installations on Windows and Linux.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution with the permissions of the current user. Potential consequences include theft of customer and marketing data, exposure of credentials stored for connected systems, email infrastructure takeover, and lateral movement. Adjacent marketing systems, databases, and downstream mail transfer agents could also be affected. These broader consequences are potential outcomes, not documented exploitation results.
If you can’t patch tonight, do this now.
If patching must be delayed, restrict Adobe Campaign Classic access to trusted networks and limit public internet exposure. Inventory deployments and installed versions, and monitor for unexpected template-processing activity and indications of code execution. If compromise is suspected, investigate exposed customer data and connected systems, and rotate credentials stored in Adobe Campaign Classic.
Patch, then assume compromise.
Apply Adobe security update APSB26-120 and upgrade affected Adobe Campaign Classic v7 installations to version 7.4.3 build 9399 or an applicable later fixed build. Verify patch installation across all deployments. There is conflicting release guidance: another account identifies versions 7.0.1 and 7.4.4 or later as fixed, whereas the vulnerability-specific affected-version information identifies 7.4.3 build 9399 as unaffected. Confirm the appropriate fixed build for the installed release with Adobe's bulletin. Adobe-hosted instances are reported to have already been remediated; verify their patch status with Adobe.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.