Critical Adobe Campaign Classic flaw gives unauthenticated attackers code execution

Adobe patched a critical flaw in Campaign Classic, its enterprise marketing automation platform, that can let an attacker run code without any user interaction. Tracked as CVE-2026-48449 and scored 10.0, it is an incorrect authorization issue leading to arbitrary code execution in the context of the current user. The same update fixes a high-severity SQL injection flaw that allows arbitrary file reads. Affected versions are Campaign Classic v7 build 9397 and earlier on Windows and Linux, mostly on-premises and hybrid deployments, with a fix in build 9398. Adobe says it is not aware of exploitation, and separately patched eight critical flaws in Adobe Bridge.

Check

Identify on-premises or hybrid Adobe Campaign Classic instances, confirm the build number, and update to 7.4.3 build 9398, prioritizing any instance reachable from untrusted networks.

Affected

Organizations running Adobe Campaign Classic v7 build 9397 or earlier (CVE-2026-48449); the incorrect authorization flaw allows code execution with no user interaction, and a companion flaw enables arbitrary file reads.

Fix

Apply Adobe's update to build 9398, restrict access to the Campaign Classic interface, and review the server for unexpected code execution or file access, since the flaw needs no interaction to exploit.