Adobe Campaign Classic: unauthenticated RCE in CVE-2026-48449

Adobe has updated its Campaign Classic v7 bulletin with two vulnerabilities affecting a system that connects customer data, campaign automation and communication channels. CVE-2026-48449 has a CVSS score of 10.0 because an unauthenticated attacker can achieve arbitrary code execution. CVE-2026-48448 enables remote filesystem reads through SQL injection and has a score of 8.6.

The most important operational distinction is the hosting model. The defects affect fully on-premises deployments and the customer-managed components of hybrid environments. Adobe says it has remediated Adobe-hosted environments, whose customers do not need to take additional action for this update.

What Adobe confirms

Adobe’s APSB26-114 bulletin, published on 29 July and updated on 30 July, lists:

CVE	Weakness	CVSS	Impact
CVE-2026-48449	improper authorisation	10.0	arbitrary code execution
CVE-2026-48448	SQL injection	8.6	arbitrary filesystem read

Both vulnerabilities can be exploited over the network, without privileges and without user interaction. CVE-2026-48449 carries the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: low attack complexity, changed security scope and high impact on confidentiality, integrity and availability.

Adobe was not aware of exploitation in the wild when it published the bulletin. That absence should not be interpreted as a relaxed maintenance window: the vendor assigns the update Priority 1, its highest patching priority.

Affected versions and architectures

Adobe Campaign Classic v7 7.4.3 build 9397 and earlier is affected on Windows and Linux. Build 9398 contains the fixes.

Teams should establish more than the version displayed in one console:

whether the instance is fully on-premises, hybrid or Adobe hosted;
which hybrid components remain customer managed;
whether a public reverse proxy, load balancer or WAF routes traffic to Campaign;
whether application, marketing and execution nodes run the same build;
whether a standby node or recovery image still contains an older build.

Responsibility is not uniform in a hybrid design. Adobe’s remediation of its component does not automatically update the customer’s on-premises component.

Why a campaign platform is a high-value target

A marketing campaign platform processes customer profiles, segments, communication history, message templates and integration data. It frequently communicates with CRM systems, data warehouses, email infrastructure, file services and APIs.

RCE on such a system is not necessarily confined to one process. Depending on its permissions, an attacker could gain:

access to recipient and segmentation data;
the ability to alter campaign content or links;
integration credentials;
an entry point into adjacent systems;
a trusted phishing channel using the organisation’s legitimate domain;
the ability to disrupt sends or undermine report integrity.

This is potential-impact analysis, not a claim that all these outcomes occurred. Their feasibility depends on the service account, segmentation and secrets available on each deployment.

RCE and file disclosure form one response problem

The two vulnerabilities should be assessed as a combined risk area. File disclosure can expose configuration, keys and credentials. Code execution can alter system state, establish persistence or abuse trusted integrations. Even after the defect is patched, an attacker may retain a stolen credential.

Closing the exposure therefore requires three parallel actions:

deploy build 9398;
investigate whether the defect may have been used;
revoke secrets the instance stored or could read.

A WAF may reduce some attack traffic but should not replace the update. A filter depends on known request patterns, while authorisation defects and SQL injection may be expressed in more than one way.

A safe patching plan

Back up the required data and configuration before the change, but do not blindly clone an entire potentially compromised machine into the future production environment. Record the active build, the node inventory and the maintenance start time.

Then:

obtain the package through Adobe’s official channel;
verify package integrity;
update every customer-managed Campaign Classic node;
restart the required services and confirm the effective build;
test delivery, workflow processing and critical integrations;
verify that no traffic reaches an omitted legacy node;
document exceptions and assign an owner and deadline.

Where immediate patching is impossible, restrict network access to trusted sources, disable unnecessary public interfaces and increase monitoring. These measures reduce exposure; they are not full remediation.

Investigating after the update

The available evidence depends on architecture, so correlate:

reverse-proxy, WAF and load-balancer logs;
Campaign web and application logs;
database queries and SQL errors;
process, service and task creation on the host;
changes to files, templates, workflows and accounts;
use of integration credentials originating from the instance;
unusual profile exports or growth in data volume.

Do not search only for CVE identifiers. Hunt for outcomes: anonymous access to sensitive functions, query-parser errors, unusual file reads, child processes spawned by Campaign and outbound connections absent from the normal profile.

Handling credentials

Rotation scope should match what the Campaign process could read. A typical set includes:

database and data-warehouse accounts;
SMTP keys and communication-provider APIs;
CRM and marketing integration secrets;
operating-system service accounts;
certificates, SSH keys and automation tokens;
administrator credentials stored in configuration.

Rotate in a controlled sequence to preserve telemetry and avoid unplanned disruption of critical workflows. At the same time, do not wait for perfect proof that one secret was read where the service was internet exposed and logging is incomplete.

Primary facts versus Breachroad analysis

Adobe confirms the affected versions, two vulnerability classes, lack of required privileges and user interaction, impact, patch priority and absence of known exploitation at publication. It also distinguishes Adobe-hosted, on-premises and hybrid environments.

Breachroad concludes that the business impact may exceed the technical shorthand “RCE on a server.” A compromised campaign platform can combine sensitive data with a trusted communication channel. Post-patch review should therefore cover content, integrations and identities, not only service availability.

Cybersecurity training for administrators and marketing teams connects technical response with communication-process protection. An IT security audit can assess versions, segmentation, secrets, logging and the reach of Campaign integrations.