Loading vulnerability…
SQL Injection in Adobe Campaign Classic
CVE-2026-48326 is an SQL injection vulnerability in Adobe Campaign Classic caused by improper neutralization of special elements used in SQL commands. The flaw affects Adobe Campaign Classic version 7 through version 7.4.3 build 9398 on Windows and Linux. A low-privileged attacker can exploit the issue remotely to execute arbitrary code in the context of the current user. User interaction is not required, and the vulnerability has changed scope.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary code execution in the context of the current user. The CVSS v3.1 vector indicates high confidentiality, integrity, and availability impact with changed scope, allowing compromise effects beyond the initially vulnerable security authority.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting network access to Adobe Campaign Classic, particularly for internet-facing and externally accessible deployments, and limit access to trusted administrative and application users only. Review and minimize low-privilege account access, enforce strong credential hygiene to reduce the risk of credential misuse, and monitor for suspicious authenticated activity targeting application database interactions until the update can be applied.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic to version 7.4.3 build 9399, which is listed as unaffected. Apply Adobe's security update for APSB26-120 to affected on-premise and hybrid deployments. Adobe-hosted instances were remediated by Adobe.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.