Loading vulnerability…
SQL Injection RCE in Adobe Campaign Classic
CVE-2026-48330 is an SQL injection vulnerability in Adobe Campaign Classic caused by improper neutralization of special elements used in SQL commands. The flaw affects Adobe Campaign Classic v7 through v7.4.3 build 9398. A remote attacker can submit crafted input to execute arbitrary SQL commands, resulting in arbitrary code execution in the context of the current user. The vulnerability has a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthenticated remote execution of arbitrary SQL commands and may result in arbitrary code execution under the current application user context. An attacker may gain elevated access or control over the application and cause high-impact compromise of confidentiality, integrity, and availability, including modification or exposure of application-accessible data.
If you can’t patch tonight, do this now.
No vendor-provided workaround is specified. Until patched, reduce exposure by restricting access to Adobe Campaign Classic to trusted networks and authorized clients, particularly for internet-facing or externally accessible deployments.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic to v7.4.3 build 9399 or a later vendor-supported release containing the fix. Adobe-hosted instances were remediated by Adobe; on-premise and hybrid deployments require customer remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.