Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to gain file system read access. Exploitation of this issue does not require user interaction. Scope is changed.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 3 products
| Date | Total | Labels |
|---|
| 2026-07-30 | 2 | Disclosure1General1 |
| 2026-07-31 | 3 | Disclosure1Patch2 |
| 2026-08-01 | 5 | Patch5 |
| 2026-08-02 | 1 | Patch1 |
| 2026-08-03 | 1 | Patch1 |
| 2026-08-04 | 1 | Patch1 |
| 2026-08-10 | 1 | Patch1 |
| 2026-09-17 | 1 | Disclosure1 |
Adobe published a security advisory for yet another unauthenticated RCE and SQLi that I found in Adobe Campaign. CVE-2026-48449 & CVE-2026-48448: https://helpx.adobe.com/security/products/campaign/apsb26-114.html Many more to come.
Post summary
Adobe has publicly disclosed two new unauthenticated RCE and SQLi vulnerabilities (CVE‑2026‑48449 & CVE‑2026‑48448) in Adobe Campaign through a security advisory.
Adobe has released an urgent security update for Adobe Campaign Classic after a critical flaw was found that could allow arbitrary code execution without user interaction. Tracked as CVE-2026-48449, the vulnerability carries a maximum severity score and affects Adobe Campaign Classic v7 7.4.3 build 9397 and earlier. Adobe also patched CVE-2026-48448, a SQL injection flaw that could allow attackers to read arbitrary files from the system. For organizations using Adobe Campaign Classic, this is a high priority patching issue. Marketing automation platforms often connect to customer data, campaign workflows, email systems, and internal business processes, which makes compromise especially risky. Affected users should update to Adobe Campaign Classic v7 7.4.3 build 9398 or later immediately, review access controls, and monitor systems for suspicious activity. When a marketing platform can become a code execution risk, patching is not just an IT task. It is customer data protection. #AdobeCampaignClassic #CVE202648449 #CVE202648448 #VulnerabilityManagement #PatchManagement #ApplicationSecurity #DataSecurity #MarketingSecurity #Cybersecurity #CyberRisk
Post summary
Adobe released an urgent update for Adobe Campaign Classic to patch a critical RCE flaw (CVE-2026-48449) and a SQL injection flaw (CVE-2026-48448). Users are advised to upgrade to build 9398 or later and adjust access controls.
Adobe Campaign の深刻な脆弱性 CVE-2026-48449／48448 が FIX：RCE と SQLi の恐れ https://iototsecnews.jp/2026/07/31/critical-adobe-campaign-flaw-lets-attackers-execute-arbitrary-code/ Adobe Campaign Classic において、認証制御や入力処理の不備に起因する深刻な脆弱性 CVE-2026-48449／CVE-2026-48448 が公表されました。この問題の原因は、アクセス権限の検証不足やデータベース命令の処理の不備にあります。悪用された場合、外部から不正な命令を実行されたり、内部ファイルが閲覧されて機密データが露出する恐れがあります。対応策として、修正が含まれるビルドへのバージョンアップやアクセスログの点検が有効です。システムを安全に利用するためにも、ネットワーク制限を講じた上で、速やかに更新を実施することが推奨されます。 #Adobe #Campaign #CVE202648448 #CVE202648449 #Vulnerability
Post summary
The article discloses critical CVEs in Adobe Campaign Classic, details RCE and SQLi risks, and recommends upgrading to a patched version and monitoring logs to mitigate the vulnerability.
2/3 The bug is an incorrect authorization issue leading to arbitrary code execution as the current user, no clicks needed. Adobe also fixed CVE-2026-48448 (CVSS 8.6), an SQL injection allowing arbitrary file reads. #CVE #InfoSec #CyberSecurity
Post summary
The tweet details an authorization flaw allowing code execution, notes Adobe’s patch for CVE‑2026‑48448 (an SQL injection), and cites a CVSS score, with no mention of PoC, exploit code, or active attacks.
@Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system. It has been described as a case of incorrect authorization that could result in arbitrary code execution in the context of the current user without requiring any user interaction. The update also resolves another high-severity flaw (CVE-2026-48448, CVSS score: 8.6) stemming from SQL injection that could pave the way for arbitrary file reads. "This update addresses critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read," Adobe said in an advisory. The company noted that it's not aware of any of the flaws being exploited in the wild. Both shortcomings have been addressed in ACC v7: 7.4.3 build 9398 for Windows and Linux.
Post summary
Adobe has issued patches for CVE-2026-48449 (arbitrary code execution) and CVE-2026-48448 (SQL injection leading to file reads), with no evidence of active exploitation reported.
CVE-2026-48448: Adobe Campaign Classic SQL Injection - What It Means for Your Business and How to Respond https://hubs.li/Q04xQbW70
Post summary
The text announces a SQL Injection vulnerability in Adobe Campaign Classic associated with CVE-2026-48448 and links to a response-focused article. It provides basic technical detail but lacks explicit PoC, exploit, active exploitation, or patch information.
#securityupdate #adobeupdate #adobe #CampaignClassic Adobe から，Campaign Classic で更新をリリース． 適用優先度「1」，緊急度には「Critical」 2 件（CVSS スコア 10.0 1 件）が含まれる． ・CVE-2026-48448 ・CVE-2026-48449 https://x.com/kawn2020/status/2084474176086462540
Post summary
Adobe has released a critical security update for Campaign Classic to address CVE-2026-48448 and CVE-2026-48449, providing a patch for these high‑severity vulnerabilities.
⚠️ VULNERABILIDAD CRÍTICA | CVE-2026-48449 en Adobe Campaign Classic: CVSS 10.0 con RCE sin interacción del usuario. Adobe publicó hoy parches de emergencia para Adobe Campaign Classic (ACC), su plataforma de automatización de marketing empresarial, con una vulnerabilidad de severidad máxima que permite ejecución de código arbitrario sin ninguna interacción del usuario. Sin explotación activa reportada al momento del advisory. CVSS: 10.0 (Crítico) 🔍 Vulnerabilidades parcheadas 1️⃣ CVE-2026-48449 (CVSS 10.0): Autorización incorrecta en Adobe Campaign Classic que permite RCE en el contexto del usuario actual sin requerir interacción. Vector de red, sin autenticación previa requerida. Impacto total en confidencialidad, integridad y disponibilidad. El CVSS 10.0 es la calificación máxima posible. 2️⃣ CVE-2026-48448 (CVSS 8.6): SQL Injection en ACC que permite lectura arbitraria del sistema de archivos. Combinado con el RCE anterior, un atacante podría exfiltrar configuraciones sensibles, credenciales de base de datos y datos de campañas de clientes antes de comprometer el sistema. Versión corregida: ACC v7 build 9398 disponible para Windows y Linux. 3️⃣ Adobe Bridge: 8 vulnerabilidades críticas adicionales parcheadas en el mismo ciclo. Destacan CVE-2026-48395 y CVE-2026-48396 (CVSS 8.6) con RCE via untrusted search path y autorización incorrecta, CVE-2026-48390 (CVSS 8.6) con escalada de privilegios, y cuatro vulnerabilidades de out-of-bounds write y path traversal con CVSS entre 7.8 y 8.2. 🛡️ Recomendaciones ISO 27001 ✅ A.12.6 Gestión de vulnerabilidades: Actualiza Adobe Campaign Classic a la versión 7.4.3 build 9398 de inmediato en todos los entornos Windows y Linux. Con CVSS 10.0 y vector de red sin autenticación, esta vulnerabilidad debe tener la prioridad más alta en la cola de parchado de hoy. ✅ A.13.1 Segmentación de red: Si el parche no puede aplicarse de inmediato, restringe el acceso a los puertos de ACC a IPs corporativas aprobadas mediante firewall perimetral. Reducir la superficie de exposición de red es el control compensatorio más efectivo mientras se despliega el parche. ✅ A.12.4 Monitoreo: Habilita logging detallado en ACC y monitorea intentos de acceso no autorizados, ejecución de consultas SQL inusuales y procesos hijo generados por el servidor de Campaign. Aunque Adobe indica que no hay explotación activa, el disclosure público aumenta el riesgo de weaponización. Versiones afectadas: ACC v7 anteriores a build 9398 Fix: Actualizar a ACC v7.4.3 build 9398 🔗 https://thehackernews.com/2026/08/adobe-campaign-classic-cvss-100-flaw.html 🔗 Advisory Adobe: https://helpx.adobe.com/security/products/campaign/apsb26-114.html #CyberSecurity #Adobe #CVE202648449 #RCE #CVSS10 #AdobeCampaign #VulnerabilityManagement #PatchNow #ISO27001 #HInsideSecurity #DFIR #SQLInjection #EnterpriseSecurity #RedTeam
Post summary
Adobe released emergency patches for CVE‑2026‑48449, a critical remote code execution flaw in Campaign Classic; no active exploitation is reported, but the advisory details the vulnerability and remediation steps.
Adobe patched a maximum severity flaw in Campaign Classic, its enterprise marketing automation platform. CVE-2026-48449 scores a perfect 10.0 on CVSS: incorrect authorization lets an attacker run arbitrary code without any user interaction. A second bug, CVE-2026-48448 (8.6), allows arbitrary file reads via SQL injection. Adobe says neither is being exploited in the wild; patch is in ACC v7 7.4.3 build 9398.
Post summary
Adobe reported two critical vulnerabilities in Campaign Classic, released a patch (ACC v7 7.4.3 build 9398) and confirmed they are not currently exploited in the wild.
Adobe patched a CVSS 10.0 flaw in Campaign Classic, CVE-2026-48449, that could enable code execution without user interaction. It also fixed CVE-2026-48448, an SQL injection bug tied to file reads. #Adobe #CampaignClassic #CVE202648449 https://www.hendryadrian.com/adobe-campaign-classic-cvss-10-0-flaw-could-run-code-without-user-interaction/
Post summary
Adobe has released patches for CVE‑2026‑48449, a critical RCE vulnerability, and CVE‑2026‑48448, an SQL injection flaw tied to file reads.
🚨 CVSS 10.0 alert Adobe Campaign Classic CVE-2026-48449 Adobe Campaign Classic (on-prem, v7 ≤7.4.3.9397) has a critical unauthenticated RCE flaw (CVE-2026-48449) — no login, no user interaction needed. Paired with a second CVSS 8.6 SQLi bug (CVE-2026-48448), attackers could chain the two for full compromise. This is the 2nd CVSS 10.0 bug in this product in a month. Patch to build 7.4.3.9398 now.
Post summary
Adobe Campaign Classic is affected by an unauthenticated RCE (CVE-2026‑48449) and a chained SQLi flaw, but a patch (build 7.4.3.9398) is already available.
Warning: 1 critical and 1 high incorrect authorization and sql injection in #Adobe Campaign Classic. #CVE-2026-48449 #CVE-2026-48448 CVSS: 10-8.6. A remote attacker without user interaction can exploit them to execute arbitrary code and gain file system read access. #Patch #Patch
Post summary
The tweet alerts of critical and high severity authorization and SQL injection flaws in Adobe Campaign Classic (CVE‑2026‑48449 & CVE‑2026‑48448) with CVSS scores 10–8.6, and indicates that a patch is available.
Adobe just dropped an emergency patch (APSB26-114) for Adobe Campaign Classic fixing two critical flaws on-premise admins need to act on now. CVE-2026-48449 is an incorrect authorization bug scoring a perfect 10.0 CVSS — no privileges or user interaction needed, full RCE. CVE-2026-48448 is a SQL injection flaw (8.6) that lets attackers read files off the system without authentication. Both hit Campaign Classic v7 builds 7.4.3.9397 and earlier; fix is build 7.4.3.9398. Adobe-hosted instances are already patched server-side — only on-prem and hybrid on-prem components need manual updates.
Post summary
Adobe issued an emergency patch for Adobe Campaign Classic to remediate two critical vulnerabilities—one allowing remote code execution and another enabling SQL injection without authentication.
🚨*CVE* CVE-2026-48448 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to d… https://www.cve.org/CVERecord?id=CVE-2026-48448 ----- Traducción: CVE-2026-48448 Ado… http://infoflow.cloud`
Post summary
The entry merely references a CVE record describing an SQL injection vulnerability in Adobe Campaign Classic, without any PoC, exploit, active usage, or mitigation details.
CVE-2026-48448 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to d… https://www.cve.org/CVERecord?id=CVE-2026-48448
Post summary
The text announces that Adobe Campaign Classic (ACC) has a SQL Injection vulnerability (CVE-2026-48448), but offers no PoC, exploit, active exploitation, patch, or false-positive claim.
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | adobe | campaign | - | - | - |
| App | adobe | campaign | 7.4.3 | - | - |
| App | adobe | campaign | 7.4.3 | - | - |
| App | adobe | campaign | 7.4.3 | - | - |
| App | adobe | campaign | 7.4.3 | - | - |
| OS | linux | linux_kernel | - | - | - |
| OS | microsoft | windows | - | - | - |