Adobe Campaign Classic: Critical CVSS 10.0 Patch for On-Premise…

Adobe has fixed CVE-2026-48449, a maximum-severity vulnerability in Campaign Classic that allows unauthenticated remote code execution. Only fully on-premise deployments and on-premise components of hybrid environments are affected; Adobe-hosted instances have already been remediated.

Adobe released security update APSB26-114 on July 29, 2026 to address a maximum-severity vulnerability in Adobe Campaign Classic. CVE-2026-48449 carries a CVSS score of 10.0, the highest on the scale: an unauthenticated remote attacker can execute arbitrary code without user interaction, with total impact on confidentiality, integrity, and availability. The bulletin's severity is amplified by its selective scope: it affects only fully on-premise deployments and on-premise components of hybrid environments, while Adobe-hosted instances have already been remediated without customer action.

Key Takeaways

CVE-2026-48449 has CVSS 10.0 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: exploitable from the network, no prerequisites, with changed scope indicating impact beyond the vulnerable component.
The vulnerability is classified as CWE-863 Incorrect Authorization: an error in authorization checks allows arbitrary code execution in the context of the service user.
Affected versions are ACC v7 up to build 9397 on Windows and Linux; build 9398 is the available fix, with priority rating 1, the highest urgency on Adobe's scale.
The bulletin applies only to on-premise deployments and on-premise components of hybrid environments: hosted instances are already protected, creating a risk discontinuity between SaaS and proprietary infrastructure.

The Mechanism: An Authorization Error with Systemic Impact

The official CVE record, confirmed by NVD and the Adobe bulletin, identifies the flaw as CWE-863 Incorrect Authorization. This category indicates the software does not correctly implement an authorization check, allowing an actor to act outside their intended permissions. According to the Adobe advisory, the vulnerability "could result in arbitrary code execution in the context of the current user without requiring any user interaction."

The full CVSS:3.1 vector — AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — is unambiguous about the attack surface: network accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N). The S:C (scope changed) parameter signals that impact extends beyond the vulnerable component's boundary, reaching other components or resources of the underlying system. This configuration represents the most dangerous combination in the CVSS 3.1 methodology.

"This update addresses critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read" — Adobe Security Bulletin APSB26-114

The On-Premise Divide: Two Speeds in Risk Management

The Adobe advisory contains a rarity in enterprise security bulletins: an explicit exclusion clause for cloud instances. "This security bulletin applies only to fully on-premise deployments and on-premise components of hybrid deployments," reads the official text. "Adobe-hosted instances have already been remediated."

This operational distinction reveals a risk stratification that security teams must decode quickly. Organizations that have migrated Campaign workloads to Adobe infrastructure are protected by the vendor; those retaining direct control of servers, for compliance, customization, or data residency reasons, must act independently. The hybrid scenario adds complexity: even if the primary component is hosted, any connected on-premise nodes require independent patching.

The dichotomy raises questions about risk governance in multi-deployment models. According to CyberPress, from August 11, 2026 Adobe may consolidate internal CVEs with the same severity and CWE into a single identifier, a process change that marks a maturation in vulnerability management but does not alter the immediate urgency for this specific flaw.

Context: CVE-2026-48448, SQL Injection with File System Read

Bulletin APSB26-114 also addresses a second vulnerability, CVE-2026-48448, with a CVSS score of 8.6 HIGH. This is a SQL injection that allows arbitrary file system read — with impact on confidentiality but not integrity or availability, as reflected in the CVSS vector with C:H, I:N, A:N. This flaw also requires no user interaction and no privileges, with changed scope.

The presence of two unauthenticated vulnerabilities in the same bulletin, both with changed scope, suggests an extended attack surface in Campaign Classic's query handling and access controls. The dossier does not specify whether the two flaws are technically correlated or represent independent vectors. Adobe has not attributed the discovery of either CVE to external researchers.

Immediate Actions

Apply build 9398 immediately on all on-premise ACC v7 servers and on-premise components of hybrid environments, for both Windows and Linux platforms. Priority rating 1 indicates maximum urgency on Adobe's scale.
Verify deployment inventory to identify hybrid instances with on-premise components still exposed: automatic protection of hosted portions does not extend coverage to local nodes.
Confirm CVE-2026-48448 is included in the patching cycle: build 9398 fixes both vulnerabilities, but separate tracking of the two CVEs in internal systems risks overlooking the second flaw.
Document remediation status considering Adobe has stated it is not aware of exploits in the wild at the time of publication; this absence of evidence does not eliminate the attack surface given by remote exploitability without prerequisites.

Analysis: The Boundary of Responsibility in Enterprise Software

The structure of bulletin APSB26-114 itself serves as an X-ray of responsibility models in software security. Adobe remediated the vulnerability in its own hosted systems before even publishing the advisory, while delegating the final action to on-premise customers. This risk architecture — vendor-assured in the cloud, self-assured on-premise — is standard in the industry, but the maximum severity of the flaw highlights its tension points.

The CVSS 10.0 with no access prerequisites makes CVE-2026-48449 an ideal target for automated vulnerable surface scanning. Adobe's statement on the absence of in-the-wild exploits is a temporal observation, not a prognostic guarantee: the network-exploitable nature of the flaw reduces reaction time once a PoC or exploit becomes public. For security teams, the discriminator is no longer whether to patch, but whether the on-premise inventory is complete and updated to the correct build.

The CVE consolidation slated for August 11, 2026 also introduces a discontinuity in tracking: organizations that have integrated CVE-2026-48449 into their vulnerability management systems will need to verify how Adobe will handle identifier redefinition for future flaws with a similar profile.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references