Originally published on CyberNetSec.
Executive Summary
Adobe has released an urgent security update for its Adobe Campaign Classic (ACC) marketing automation platform, addressing a critical vulnerability, CVE-2026-48449, that has been assigned the maximum possible CVSS severity score of 10.0. This flaw could permit a remote, unauthenticated attacker to execute arbitrary code on the server, requiring no user interaction. The patch also resolves a high-severity SQL injection vulnerability. Adobe is not aware of any active exploitation, but due to the severity, immediate patching is recommended for all on-premise and hybrid customers.
Vulnerability Details
The security update addresses two main vulnerabilities:
- CVE-2026-48449 (CVSS 10.0 - Critical): An incorrect authorization vulnerability that can be exploited by an unauthenticated attacker to achieve remote code execution (RCE). The attack complexity is low, and no user interaction is required, making it extremely dangerous.
- CVE-2026-48448 (CVSS 8.6 - High): An SQL injection vulnerability that could be leveraged by an attacker for arbitrary file system reads.
Combined, these vulnerabilities could allow an attacker to fully compromise the server hosting Adobe Campaign Classic, leading to data theft, further network intrusion, and complete system takeover.
Affected Systems
- Product: Adobe Campaign Classic (ACC) v7
- Affected Versions: 7.4.3 build 9397 and earlier
- Platforms: Windows and Linux (on-premise and hybrid deployments)
- Patched Version: 7.4.3 build 9398
Adobe has confirmed that its fully hosted instances have already been patched and are no longer vulnerable.
Exploitation Status
As of the advisory's release on August 1, 2026, Adobe is not aware of any exploits for these vulnerabilities being used in the wild. However, the public disclosure of a CVSS 10.0 vulnerability often attracts attention from both security researchers and malicious actors, making rapid development of a functional exploit likely. Organizations should patch before exploits become available.
Impact Assessment
A successful exploit of CVE-2026-48449 would have a catastrophic impact. Adobe Campaign Classic is used to manage customer data, marketing campaigns, and communications. An attacker with RCE on the ACC server could access and exfiltrate sensitive customer Personally Identifiable Information (PII), deploy ransomware, use the server as a pivot point to attack other systems within the corporate network, or manipulate marketing campaigns for malicious purposes. The potential for reputational damage and regulatory fines (e.g., under GDPR or CCPA) is extremely high.
Cyber Observables — Hunting Hints
As there is no known exploitation, hunting should focus on identifying vulnerable systems and monitoring for post-patch indicators of compromise.
| Type | Value | Description |
|---|---|---|
| File Name |
nlserver.exe (Windows) / nlserver (Linux) |
The main ACC server process. Monitor for anomalous behavior, child processes, or network connections from this process. |
| URL Pattern | /campaign/ |
Default path for ACC installations. Monitor web logs for unusual requests or payloads targeting this path. |
| Log Source | ACC Application Logs |
Review application logs for errors or entries related to authorization failures or unexpected SQL queries. |
Detection Methods
- Asset & Version Identification: The first step is to identify all instances of Adobe Campaign Classic within the environment and verify their version and build number. This can be done through asset management systems or by checking the application's administrative interface.
- Web Log Analysis: Security teams should monitor web server logs for the ACC instance, looking for any unusual or malformed requests that could indicate scanning or exploitation attempts. D3FEND's Web Session Activity Analysis (
D3-WSAA) can help identify anomalous request patterns. - Endpoint Monitoring: Monitor the underlying server (Windows or Linux) for any suspicious process creation, file modification, or outbound network connections originating from the ACC service account or processes.
Remediation Steps
- Apply the Patch: The primary and most critical action is to upgrade all on-premise and hybrid Adobe Campaign Classic v7 installations to version 7.4.3 build 9398. This is a direct application of MITRE's Update Software (
M1051). - Restrict Access: As a compensating control, ensure that the ACC server's management interface is not exposed to the public internet. Access should be restricted to a limited set of administrative IP addresses or placed behind a VPN. This aligns with Limit Access to Resource Over Network (
M1035). - Review Logs: After patching, review historical web and application logs for any signs of exploitation attempts that may have occurred prior to the patch being applied.
Top comments (0)