Loading vulnerability…
Privilege Escalation in Adobe Campaign Classic
CVE-2026-48333 is an incorrect authorization vulnerability in Adobe Campaign Classic (ACC) v7 through 7.4.3 build 9398. Insufficient authorization enforcement can allow a remote attacker to obtain elevated privileges. The issue is rated CVSS v3.1 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables elevation to higher privileges and can compromise the confidentiality, integrity, and availability of the affected ACC system. An attacker with elevated privileges could access or alter sensitive campaign and customer data, change application configuration, and potentially compromise connected infrastructure or services accessible to the ACC deployment.
If you can’t patch tonight, do this now.
Apply the vendor update on an urgent basis, particularly for internet-facing or externally accessible ACC deployments. Until patching is complete, restrict network access to ACC administrative and application interfaces to trusted networks and users, minimize exposed services, and monitor for unauthorized privilege changes or anomalous administrative activity.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic v7 to version 7.4.3 build 9399 or a later vendor-supported release containing the fix. Adobe-hosted ACC instances have already been remediated; the update applies to affected on-premises and hybrid deployments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.