Full research report
Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
Executive assessment
The strongest evidence is Adobe-authored CVE data showing that CVE-2026-48449 is remotely reachable without authentication or user interaction and affects Campaign Classic through build 9397. Its CVSS 10.0 rating reflects potential compromise of confidentiality, integrity and availability across a changed security scope, while CVE-2026-48448 provides a separate route to sensitive data and filesystem reads. Neither CISA's catalogue search nor the reviewed public-code search supplied evidence of current exploitation, and Adobe reportedly knew of none at release time. Defenders should therefore treat this as an urgent exposure-reduction and patch-verification event, not as a confirmed active campaign.
What happened
Adobe published records on 30 July 2026 for two Adobe Campaign Classic vulnerabilities addressed by security update APSB26-114. CVE-2026-48449 is a CVSS 10.0 incorrect-authorisation flaw permitting arbitrary code execution, while CVE-2026-48448 is a CVSS 8.6 SQL-injection flaw permitting filesystem reads; both require no user interaction. Reporting on 1 August identified Adobe Campaign Classic 7.4.3 build 9398 as the corrected Windows and Linux build.
Affected scope
Adobe's CVE record marks Adobe Campaign Classic versions from 0 through 7.4.3 build 9397 as affected by CVE-2026-48449 and build 9398 as unaffected. The same update addresses CVE-2026-48448. The eight Adobe Bridge CVEs mentioned in the broader release reporting affect a separate product and are not part of this focused Campaign Classic event.
Technical assessment
CVE-2026-48449 crosses an authorisation boundary and can produce arbitrary code execution in the current-user context; its CVSS vector indicates network access, low complexity, no privileges and no user interaction. CVE-2026-48448 improperly handles SQL elements, enabling sensitive-memory disclosure and filesystem read access under similarly unauthenticated, network-reachable conditions. These characteristics make exposed Campaign Classic services high-priority patch targets, but they do not establish that exploitation has occurred.
Recommended defensive actions
- Upgrade Adobe Campaign Classic on Windows and Linux to 7.4.3 build 9398 or a later supported release.
- Inventory Campaign Classic deployments and verify their exact build numbers, prioritising internet-accessible instances.
- Restrict network access to Campaign Classic administration and application interfaces to trusted sources until upgrading is complete.
- Monitor Campaign Classic hosts for unexpected child processes, anomalous service-account activity and unusual database or filesystem reads.
- Review application, web-proxy and database logs for unexplained unauthenticated requests or activity preceding the upgrade.
Uncertainties and evidence gaps
- Adobe has not publicly described the affected endpoint, attack artefacts or product-specific detection indicators in the reviewed records.
- No public proof-of-concept was found, but repository search coverage is incomplete and absence of public code does not preclude private exploit development.
- CISA's catalogue did not list CVE-2026-48449 during this investigation, but catalogue absence is not proof that exploitation has never occurred.
- The reviewed CVE record exposed explicit version status for CVE-2026-48449; the shared fixed-build status for CVE-2026-48448 is supported by release reporting rather than visible version detail in that record.
- The supplied reporting identifies CVE-2026-48374, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-48390, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-48391, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-48392, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-48393, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-48394, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-48395, but the reviewed sources did not establish its distinct role in this event.
- The supplied reporting identifies CVE-2026-48396, but the reviewed sources did not establish its distinct role in this event.
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation; Adobe reported no known in-the-wild exploitation, and no public proof-of-concept was identified in the reviewed sources.
The investigation separated the two Campaign Classic vulnerabilities from the unrelated Adobe Bridge issues included in the same release reporting. Adobe-supplied CVE records and National Vulnerability Database entries confirmed the mechanisms, remote unauthenticated characteristics and impacts, while the Campaign Classic record established the affected and corrected builds. Checks of CISA's exploitation catalogue and public GitHub repositories found no current exploitation listing or public exploit repository, supporting a high-priority preventive patching assessment rather than a claim of an active campaign.
- What event and claims did the supplied report describe?Opened and reviewed the supplied article, separating the Campaign Classic update from the separate Adobe Bridge vulnerability release.thehackernews.com ↗
The report dated 1 August 2026 identified CVE-2026-48449 and CVE-2026-48448 in Campaign Classic, named build 9398 as fixed and relayed Adobe's statement that no exploitation was known.
why This framed the focused event and prevented the eight Bridge CVEs from being incorrectly attributed to Campaign Classic.
- Does an independent government vulnerability record confirm CVE-2026-48449 and its severity?Opened the National Vulnerability Database entry for CVE-2026-48449.nvd.nist.gov ↗
NVD records incorrect authorisation, arbitrary code execution without user interaction, CVSS 10.0 and a network, low-complexity, no-privilege vector.
why This corroborated the central technical claim and established that the maximum score reflects unauthenticated remote reachability, not evidence of exploitation.
- Is the second Campaign Classic vulnerability accurately characterised?Opened the National Vulnerability Database entry for CVE-2026-48448.nvd.nist.gov ↗
NVD records SQL injection that can disclose sensitive memory and provide filesystem read access, with CVSS 8.6 and no user interaction.
why This confirmed that CVE-2026-48448 belongs to the same product update but has a distinct read-oriented impact rather than the documented code-execution impact of CVE-2026-48449.
- Is current in-the-wild exploitation recognised by CISA?Searched CISA's Known Exploited Vulnerabilities Catalog for CVE-2026-48449.cisa.gov ↗
The filtered catalogue returned no matching entry.
why This provides no affirmative exploitation evidence, although catalogue absence cannot prove that exploitation has not occurred.
- Is public exploit or proof-of-concept code readily available?Searched public GitHub repositories for the exact identifier CVE-2026-48449.github.com ↗
GitHub returned zero matching repositories, although it showed incidental issues and commits containing the identifier.
why No public exploit repository was identified, but the limited search does not justify a categorical claim that no code exists anywhere.
- What exact versions and access conditions does Adobe's authoritative record state?Opened the CVE Program record populated by Adobe for CVE-2026-48449.cve.org ↗
The record marks versions through 7.4.3 build 9397 as affected and build 9398 as unaffected; it confirms network access, no privileges, no user interaction and code execution in the current-user context.
why This supplied authoritative product scope and converted the generic recommendation to update into a precise remediation threshold.
- Does Adobe's authoritative data confirm the companion SQL-injection issue?Opened the CVE Program record populated by Adobe for CVE-2026-48448.cve.org ↗
The record confirms SQL injection, sensitive-memory disclosure, filesystem read access, CVSS 8.6 and no required user interaction.
why This completed the technical assessment of the two Campaign Classic vulnerabilities without conflating their impacts.
Research coverage
All 68 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 2 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 2 corroborating, 0 contextual and 0 PoC/exploit references). 55 completed sources contained no matched information for this story.
Complete source-by-source audit 68 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| CISA KEVkev | ok1656 records | Primary evidence1 matched items | Supplied a vendor or government advisory opened and verified during focused research. |
| The Hacker Newsnews | ok4 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA Alertsnews | ok empty0 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| NVDcve | ok900 records | Corroborating2 matched items | Supplied independent analysis opened and verified during focused research. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| BleepingComputernews | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CIRCL CVEcve | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
| Cisco PSIRTvendor_advisory | ok5309 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok260 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok669 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1006 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| DNSDumpster domain IOC enrichmentresearch | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| FIRST EPSSepss | ok7445 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok5 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1588 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | failed0 records | Failed | The current collection attempt failed; this source cannot support the report. |
Additional verified pages 10 opened outside the registered collection
Vendor & gov advisories3
Adobe's official CVE record identifies unauthenticated, network-reachable incorrect authorisation leading to code execution and lists the fixed build.
Adobe's official CVE record confirms SQL injection leading to filesystem read access without user interaction.
A catalogue search returned no entry for CVE-2026-48449 at the time of investigation.
Analysis & research3
Corroborates the incorrect-authorisation classification, CVSS 10.0 vector and code-execution impact.
Corroborates the SQL-injection classification, CVSS 8.6 vector and filesystem-read impact.
Reports Adobe's 29 July 2026 security release, fixed build and statement that exploitation was not known.