CVE-2026-48449Patch(adobe / campaign)

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch adobe campaign systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

adobe CVEs Back to dashboard

2.8/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://helpx.adobe.com/security/products/campaign/apsb26-114.html

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

campaign
linux_kernel
windows

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
45 mentions across 12 observed days
Momentum state: declining

What's happening

PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 30 signals
Technical details provided in 43 signals
Disclosure: 16 classified signals
General: 2 classified signals
Peaked 7d ago at 12 mentions (2026-08-03); latest day: 1
45 total mentions across 12 days

Affected systems

Vendors

adobe linux microsoft

Products

campaignlinux_kernelwindows

2 versions affected across 3 products

Deep dive

Activity timeline45 mentions / 12d

Signal classification4 categories

Patch

2657.8%

Disclosure

1635.6%

General

24.4%

PoC

12.2%

Referenced assets35 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-30	3	Disclosure3
2026-07-31	9	Disclosure3General1Patch4PoC1
2026-08-01	11	Disclosure5Patch6
2026-08-02	3	Disclosure1Patch2
2026-08-03	12	Disclosure1General1Patch10
2026-08-04	1	Patch1
2026-08-07	1	Disclosure1
2026-08-09	1	Patch1
2026-08-10	1	Disclosure1
2026-08-14	1	Disclosure1
2026-08-27	1	Patch1
2026-09-03	1	Patch1

Full discourse20 posts

إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi86d
Disclosure
🚨 ثغرة في Adobe Campaign Classic رقمها : CVE-2026-48449 بتقييم 10 الثغره تسمح بتنفيذ كود عن بعد بدون تسجيل دخول وبدون اي تفاعل من المستخدم هذي رابع ثغرة تقيممها 10 في نفس المنتج خلال شهرين بس 😬 https://t.co/rwYxKp7jKa
Post summary
The tweet announces a critical remote‑code‑execution vulnerability (CVE‑2026‑48449) in Adobe Campaign Classic, noting its CVSS 10 score and lack of authentication requirement, but provides no evidence of exploits, PoCs, or mitigation steps.
010831.8K
50.2K followersView on X
SOCRadar®@socradar86d
Patch
A CVSS 10.0 in Adobe Campaign Classic v7. 🚨 CVE-2026-48449 is an authorization weakness leading straight to unauthenticated RCE. Adobe-hosted instances are already patched. But if you are running a customer-managed system, you need to update to 7.4.3 build 9398 ASAP to mitigate the risk and strengthen your posture. Don't let a marketing tool be your weak link. https://hubs.la/Q04rDgk80 #CyberSecurity #Adobe #VulnerabilityManagement #ThreatIntel
Post summary
The post highlights CVE‑2026‑48449, a high‑severity authorization vulnerability in Adobe Campaign Classic that allows unauthenticated RCE, and urges users of customer‑managed installations to patch to build 7.4.3 9398.
01043444
7.1K followersView on X
Daily CyberSecurity@Daily_CyberSec86d
Patch
Adobe fixes a CVSS 10 RCE in Campaign Classic (CVE-2026-48449) and eight critical flaws in Bridge. Update to build 9398 and Bridge 15.1.7 or 16.0.6 now. #AdobeCampaign #CVE202648449 #AdobeBridge #CriticalPatch #RCE http://securityexpress.info/adobe-campaign-classic-cvss-10-patch/
Post summary
Adobe has released critical patches for CVE-2026-48449—a CVSS 10 RCE in Campaign Classic—and eight additional critical flaws in Bridge, recommending users update to build 9398 or Bridge 15.1.7/16.0.6.
01050573
13.0K followersView on X
connect24h@connect24h89d
Disclosure
これは待てない。Adobe Campaign Classicに操作不要のRCE、CVE-2026-48449。CVSS 10.0だ。悪用されれば任意コード実行につながる。利用者のクリックを待たない脆弱性は、啓発メールでは止められない。CSIRTの優先度は最高でいい。アップデート必須ね。 #セキュリティソース: https://thehackernews.com/2026/08/adobe-campaign-classic-cvss-100-flaw.html
Post summary
The post announces CVE‑2026‑48449, an unprivileged RCE in Adobe Campaign Classic with CVSS 10.0, urging immediate update, but provides no PoC or exploit evidence.
00031688
8.4K followersView on X
GovCERT.CZ@GOVCERT_CZ87d
Patch
🚨 Upozorňujeme na kritickou zranitelnost v Adobe Campaign Classic, CVE-2026-48449. Zranitelnost s CVSS skóre 10 umožňuje neautentizovanému útočníkovi se síťovým přístupem vzdáleně spustit libovolný kód na zasažených systémech Adobe Campaign Classic. Úspěšné zneužití nevyžaduje autentizaci a může vést k úplnému kompromitování systému. Zranitelnost tak umožňuje převzetí kontroly nad systémem a další navazující škodlivé aktivity. Zranitelnost se týká Adobe Campaign Classic v7 verze 7.4.3 build 9397 a starších na platformách Windows a Linux. 📌Doporučujeme aktualizovat na Adobe Campaign Classic v7 verze 7.4.3 build 9398 či novější.
Post summary
The post highlights a critical 10/10 CVE-2026-48449 in Adobe Campaign Classic that allows unauthenticated remote code execution and recommends updating to build 9398 or newer to mitigate the risk.
01020536
4.3K followersView on X
Jamie Parfet@JamieParfet90d
Disclosure
Adobe published a security advisory for yet another unauthenticated RCE and SQLi that I found in Adobe Campaign. CVE-2026-48449 & CVE-2026-48448: https://helpx.adobe.com/security/products/campaign/apsb26-114.html Many more to come.
Post summary
Adobe released a security advisory for CVE-2026-48449 and CVE-2026-48448, outlining unauthenticated remote code execution and SQL injection vulnerabilities in Adobe Campaign, with a linked advisory for patch guidance.
00030268
393 followersView on X
Clone Systems@CloneSystemsInc87d
Patch
Adobe has released an urgent security update for Adobe Campaign Classic after a critical flaw was found that could allow arbitrary code execution without user interaction. Tracked as CVE-2026-48449, the vulnerability carries a maximum severity score and affects Adobe Campaign Classic v7 7.4.3 build 9397 and earlier. Adobe also patched CVE-2026-48448, a SQL injection flaw that could allow attackers to read arbitrary files from the system. For organizations using Adobe Campaign Classic, this is a high priority patching issue. Marketing automation platforms often connect to customer data, campaign workflows, email systems, and internal business processes, which makes compromise especially risky. Affected users should update to Adobe Campaign Classic v7 7.4.3 build 9398 or later immediately, review access controls, and monitor systems for suspicious activity. When a marketing platform can become a code execution risk, patching is not just an IT task. It is customer data protection. #AdobeCampaignClassic #CVE202648449 #CVE202648448 #VulnerabilityManagement #PatchManagement #ApplicationSecurity #DataSecurity #MarketingSecurity #Cybersecurity #CyberRisk
Post summary
Adobe released urgent updates for CVE-2026-48449 (arbitrary code execution) and CVE-2026-48448 (SQL injection) affecting Adobe Campaign Classic, urging immediate patching to safeguard customer data and marketing workflows.
0002091
261 followersView on X
CyberTLDR@CyberTLDR87d
Disclosure
1/3 A perfect 10.0 severity flaw hits Adobe Campaign Classic. CVE-2026-48449 lets attackers run code with zero user interaction. If you run this marketing platform, you are exposed until you patch. Are you updated? #CVE #CyberSecurity #ZeroDay #InfoSec #SummerSlam https://t.co/bqzrnrP3lN
Post summary
The tweet announces a high‑severity CVE‑2026‑48449 affecting Adobe Campaign Classic, warns of remote code execution potential, and urges users to patch.
1010097
40 followersView on X
Red Secure Tech Ltd.@redsecuretech89d
Patch
The Adobe Campaign Classic vulnerability CVE-2026-48449 allows unauthenticated RCE. Adobe also patches eight critical Bridge flaws. Update now. For More: https://www.redsecuretech.co.uk/blog/post/adobe-campaign-classic-vulnerability-critical-update-released/1365 #Adobe #CampaignClassic #CVE #CriticalVulnerability #AdobeBridge #RCE #InfoSec #CyberSecurity https://t.co/ScyfozzogH
Post summary
The post alerts users to the CVE‑2026‑48449 vulnerability that permits unauthenticated RCE in Adobe Campaign Classic and urges immediate patching.
0101069
69 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-48449 Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.… https://www.cve.org/CVERecord?id=CVE-2026-48449
Post summary
The CVE-2026-48449 entry reports an incorrect authorization flaw in Adobe Campaign Classic that could allow an attacker to execute arbitrary code as the affected user, with no mention of PoC, exploit tools, active use, or remediation.
01010899
57.9K followersView on X
iototsecnews@iototsecnews80d
Disclosure
Adobe Campaign の深刻な脆弱性 CVE-2026-48449／48448 が FIX：RCE と SQLi の恐れ https://iototsecnews.jp/2026/07/31/critical-adobe-campaign-flaw-lets-attackers-execute-arbitrary-code/ Adobe Campaign Classic において、認証制御や入力処理の不備に起因する深刻な脆弱性 CVE-2026-48449／CVE-2026-48448 が公表されました。この問題の原因は、アクセス権限の検証不足やデータベース命令の処理の不備にあります。悪用された場合、外部から不正な命令を実行されたり、内部ファイルが閲覧されて機密データが露出する恐れがあります。対応策として、修正が含まれるビルドへのバージョンアップやアクセスログの点検が有効です。システムを安全に利用するためにも、ネットワーク制限を講じた上で、速やかに更新を実施することが推奨されます。 #Adobe #Campaign #CVE202648448 #CVE202648449 #Vulnerability
Post summary
The article announces the disclosure of CVE-2026-48448/49 in Adobe Campaign Classic, describing RCE and SQL injection risks and recommending software updates as remediation.
01000166
506 followersView on X
Kaitan ID Security@KaitanSecurity82d
Disclosure
🧨 Adobe Campaign Classic — Arbitrary Code Execution at Scale CVE-2026-48449 affects Adobe Campaign Classic (ACC) with an Incorrect Authorization vulnerability that can result in arbitrary code execution in the context of the current user…
Post summary
The post announces the new Adobe Campaign Classic vulnerability CVE-2026-48449, describing an incorrect authorization flaw that allows arbitrary code execution, with no PoC, exploit code, or active exploitation reported.
1000034
88 followersView on X
Günter Born@etguenni87d
General
Nutzt wer Adobe Campaign Classic (ACC) und hat noch nicht gepatcht? Zwei fette Sicherheitslücken (CVSS 3.x von 10.0 bei einer). https://borncity.com/blog/2026/08/03/adobe-campaign-classic-schwachstelle-cve-2026-48449-cvss-3-x-10-0-gepatcht/
Post summary
The tweet advertises two serious vulnerabilities in Adobe Campaign Classic with high CVSS scores but provides no exploitation details, PoC, or patch information.
00010290
2.7K followersView on X
Zero Hunt@zerohuntai87d
Patch
Adobe Campaign Classic just took its third CVSS 10.0 authorization bypass in 50 days. CVE-2026-48449. Unauthenticated RCE, on-prem only. APSB26-114, 29 July. The build Adobe told you to install in June is the build listed as vulnerable in July. Twice in a row. https://t.co/XRGeilpHLA
Post summary
Adobe Campaign Classic’s CVE‑2026‑48449, an unauthenticated RCE with a CVSS 10.0 score, remains vulnerable in both the June‑recommended build and the July advisory, highlighting the need for applying the APSB26‑114 patch.
1000069
15 followersView on X
كاسبر سكاي@KasperskyDev87d
Patch
⚠️ ثغرة حرجة بدرجة ١٠/١٠ في منصة التسويق الاحترافية من أدوبي تُتيح تنفيذ كود بلا مصادقة. المعرّف : CVE-2026-48449 درجة الخطورة : 10.0 (CVSS) - Critical المنتج المتأثر : Adobe Campaign Classic v7 ≤ build 9397 الحل : ACC v7 build 9398 #Adobe #CVE202648449
Post summary
The text announces a critical (CVSS 10.0) unauthenticated code execution flaw in Adobe Campaign Classic v7 (build ≤9397) and provides the patch version 9398 to remediate it.
01000410
39.9K followersView on X
Offensive Lab@OffensiveLab88d
Patch
@Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system. It has been described as a case of incorrect authorization that could result in arbitrary code execution in the context of the current user without requiring any user interaction. The update also resolves another high-severity flaw (CVE-2026-48448, CVSS score: 8.6) stemming from SQL injection that could pave the way for arbitrary file reads. "This update addresses critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read," Adobe said in an advisory. The company noted that it's not aware of any of the flaws being exploited in the wild. Both shortcomings have been addressed in ACC v7: 7.4.3 build 9398 for Windows and Linux.
Post summary
Adobe issued updates for Campaign Classic to fix CVE-2026-48449 (arbitrary code execution) and CVE-2026-48448 (SQL injection), with no active exploitation reported.
00010102
152 followersView on X
ExploitGrid@exploitgrid90d
PoC
[CVE] CVE-2026-48449 [HIGH PRIORITY] #Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) 🔗 https://exploitgrid.net/cve/CVE-2026-48449
Post summary
A high-priority CVE involving incorrect authorization in Adobe Campaign Classic is referenced, with a link to an exploitgrid page presumably offering a PoC.
1000044
29 followersView on X
ExploitGrid@exploitgrid90d
General
🛡️ #ExploitGrid Daily Threat Digest Top #Vulnerabilities (#CVEs) of the day CVE-2026-48449 CVE-2026-66803 CVE-2026-12946 CVE-2026-13435 CVE-2026-58046 ..🧵👇
Post summary
The digest simply enumerates a set of CVE identifiers without providing any PoC, exploit details, patch information, or active exploitation evidence.
1000056
29 followersView on X
Daily CyberSecurity@Daily_CyberSec90d
Patch
Adobe Campaign Classic flaw CVE-2026-48449 scores a perfect CVSS 10.0 and allows arbitrary code execution. Update to build 9398 now. #AdobeCampaignClassic #CVE202648449 #RCE #Adobe #InfoSec http://securityonline.info/adobe-campaign-classic-rce/
Post summary
Adobe Campaign Classic CVE-2026-48449 is a critical RCE vulnerability (CVSS 10.0); users are urged to update to build 9398 immediately.
00010454
12.6K followersView on X
ThreatAft@ThreatAft91d
Disclosure
🔐 🚨 Adobe Campaign Classic RCE — CVSS 10.0 CVE-2026-48449: Unauthenticated authorization bypass allows RCE on marketing infrastructure. Update to 7.4.4 NOW. → http://threataft.com/articles/adobe-campaign-cve-2026-48449 #cybersecurity #infosec #Adobe #CampaignClassic #ThreatIntel
Post summary
Adobe Campaign Classic CVE-2026-48449 is a critical RCE vulnerability; users are urged to update to version 7.4.4, and a detailed article is linked.
0000167
35 followersView on X

CPE platform detail7 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

7 of 7 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	adobe	campaign	-	-	-
App	adobe	campaign	7.4.3	-	-
App	adobe	campaign	7.4.3	-	-
App	adobe	campaign	7.4.3	-	-
App	adobe	campaign	7.4.3	-	-
OS	linux	linux_kernel	-	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard adobe CVEs linux CVEs microsoft CVEs campaign vulnerabilities

What researchers are saying

CVE-2026-48449

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediDisclosure

The tweet announces a critical remote‑code‑execution vulnerability (CVE‑2026‑48449) in Adobe Campaign Classic, noting its CVSS 10 score and lack of authentication requirement, but provides no evidence of exploits, PoCs, or mitigation steps.

SOCRadar®[verified]@socradarPatch

The post highlights CVE‑2026‑48449, a high‑severity authorization vulnerability in Adobe Campaign Classic that allows unauthenticated RCE, and urges users of customer‑managed installations to patch to build 7.4.3 9398.

connect24h[verified]@connect24hDisclosure

The post announces CVE‑2026‑48449, an unprivileged RCE in Adobe Campaign Classic with CVSS 10.0, urging immediate update, but provides no PoC or exploit evidence.

GovCERT.CZ[verified]@GOVCERT_CZPatch

The post highlights a critical 10/10 CVE-2026-48449 in Adobe Campaign Classic that allows unauthenticated remote code execution and recommends updating to build 9398 or newer to mitigate the risk.

Clone Systems[verified]@CloneSystemsIncPatch

Adobe released urgent updates for CVE-2026-48449 (arbitrary code execution) and CVE-2026-48448 (SQL injection) affecting Adobe Campaign Classic, urging immediate patching to safeguard customer data and marketing workflows.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The post announces the new Adobe Campaign Classic vulnerability CVE-2026-48449, describing an incorrect authorization flaw that allows arbitrary code execution, with no PoC, exploit code, or active exploitation reported.

Offensive Lab[verified]@OffensiveLabPatch

Adobe issued updates for Campaign Classic to fix CVE-2026-48449 (arbitrary code execution) and CVE-2026-48448 (SQL injection), with no active exploitation reported.

Daily CyberSecurity@Daily_CyberSecPatch

Adobe has released critical patches for CVE-2026-48449—a CVSS 10 RCE in Campaign Classic—and eight additional critical flaws in Bridge, recommending users update to build 9398 or Bridge 15.1.7/16.0.6.