Adobe Campaign Classic just demonstrated why marketing automation platforms now belong on the same emergency patch list as VPNs and firewalls: a newly disclosed flaw in the on-premise marketing suite lets an attacker run code with no login and no clicks at all.
A Maximum-Severity Flaw With No Barrier to Entry
On August 1, 2026, Adobe published security bulletin APSB26-114, disclosing CVE-2026-48449, an incorrect-authorization flaw (CWE-863) in Campaign Classic that Adobe rated 10.0 on the CVSS 3.1 scale, the maximum possible score. The vulnerability’s CVSS vector (AV:N/AC:L/PR:N/UI:N) means it is exploitable over the network, requires low attack complexity, needs no privileges, and needs no action from a victim. According to Adobe, successful exploitation results in arbitrary code execution in the context of the current user.
The same bulletin discloses a second, high-severity flaw, CVE-2026-48448, a SQL injection issue (CWE-89) carrying a CVSS score of 8.6 that Adobe says can be used to read arbitrary files from the underlying file system. Both flaws affect Campaign Classic version 7 (ACC v7) build 9397 and earlier on Windows and Linux, and both are fixed in build 9398.
Adobe assigned the update Priority Rating 1, its most urgent tier, and stated it is not aware of any exploits in the wild for either flaw at the time of disclosure. That combination, maximum severity paired with no confirmed active exploitation yet, is exactly the window in which defenders hold the most leverage: patch before a working exploit surfaces, not after.
Why a Marketing Platform Is a Security Problem
Campaign Classic sits deep inside the customer data stack. It typically holds contact and behavioral records, integrates with CRM and commerce systems, and often runs under service accounts with broad internal network reach. A flaw that hands an unauthenticated attacker code execution on that server is not confined to the marketing team’s world: it is a foothold into whatever else that server, and its service account, can reach.
Adobe’s bulletin draws a distinction that matters for triage. Adobe-hosted (cloud) Campaign Classic instances have already been remediated by Adobe, so no customer action is required there. The exposure sits entirely with on-premise and hybrid on-premise deployments, where the customer, not Adobe, owns the patch cycle. That split is becoming a familiar risk pattern across enterprise software generally: cloud tenants inherit vendor-managed patching speed, while self-hosted and hybrid instances inherit whatever cadence a customer’s own change-management process allows, which is frequently slower than the threat timeline demands.
A Familiar Pattern for On-Premise Adobe Software
CyberTech has reported on how Citrix NetScaler and Adobe ColdFusion flaws were weaponized within hours of disclosure earlier this year, part of a broader pattern in which the interval between a vendor bulletin and the first exploitation attempt has collapsed from weeks to hours for widely deployed on-premise software. Campaign Classic’s install base skews toward large enterprises with complex customer-data integrations, exactly the kind of environment where patch testing and change windows tend to move slower than attackers do.
What This Means for the Security Leader
A CVSS 10.0 score with no required privileges and no user interaction should trigger the same response as a critical VPN or firewall flaw: emergency change control, not the normal patch cadence. Security leaders running on-premise or hybrid Campaign Classic should treat this as a today problem rather than a next-patch-cycle problem, precisely because Adobe has already flagged it Priority 1 while confirming no known exploitation, which is the best possible timing to get ahead of it.
The SQL injection flaw, CVE-2026-48448, deserves attention in its own right. File-read vulnerabilities are frequently used to pull configuration files, credentials, or connection strings that then enable lateral movement, so patching it alongside CVE-2026-48449 closes both the initial-access path and a likely follow-on path in the same maintenance window.
There is also a vendor-management lesson here for security leaders who do not run Campaign Classic. Any marketing, CRM, or customer-data platform with an on-premise or hybrid deployment option carries the same structural risk: the vendor’s cloud tenants get patched on the vendor’s timeline, but self-hosted instances depend entirely on the customer’s own vulnerability management maturity. Asset inventories that track “deployed software” without tracking “deployment model” will miss this distinction until an incident forces the question.
The gap between severity and exploitation status also says something about how patch prioritization should work in practice. Adobe’s Priority 1 rating is not a prediction that exploitation is imminent; it is a statement that the flaw’s characteristics, network-reachable, no authentication, no interaction, warrant the same urgency as if exploitation were already underway. Security teams that wait for a proof-of-concept or a CISA Known Exploited Vulnerabilities listing before escalating a Priority 1, CVSS 10.0 bulletin are, in effect, choosing to patch reactively on a flaw the vendor has already told them is worth patching proactively. The NetScaler and ColdFusion cases referenced above show how short that reactive window has become; there is no reason to expect Campaign Classic exploitation, if it comes, to move any slower.
What to Do Now
- Identify every on-premise or hybrid Campaign Classic v7 instance in the environment; Adobe-hosted instances are already remediated and need no action.
- Update to ACC v7 build 9398 or later on both Windows and Linux deployments as an emergency change, not a scheduled one.
- Until patched, restrict network exposure of Campaign Classic application servers and review access logs for anomalous requests consistent with authorization bypass or SQL injection attempts.
- Audit the permissions of the service account tied to the Campaign Classic server; because the flaw executes code in the context of the current user, limiting that account’s reach limits the blast radius of any exploitation attempt.
