Adobe Campaign Classic CVE-2026-48449: CVSS 10.0 RCE

What is this flaw?

Adobe Campaign Classic is a marketing automation platform that sends emails, SMS and notifications at scale. According to the bulletin and the NVD entry, CVE-2026-48449 is an incorrect authorization that leads to arbitrary code execution in the context of the current user. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: network-reachable, low complexity, no privileges, no interaction, changed scope. Tenable shows 9.8 instead of 10.0; the 10.0 figure is Adobe's.

Adobe has not published the entry point or the exact component. No reliable public reproduction procedure exists at this time, and none should be invented.

CVE-2026-48448 (CVSS 8.6) is a SQL injection that can allow arbitrary file reads. Both are fixed in ACC v7 7.4.3 build 9398.

Who is affected?

The bulletin states that only fully on-premise deployments and the on-premise components of hybrid deployments are affected. Adobe-hosted instances are already remediated and need no action. Versions 7.4.3 build 9397 and earlier are vulnerable.

A researcher quoted in the press notes this is the third CVSS 10.0 authorization bypass Adobe has shipped for Campaign Classic in fifty days (earlier bulletins APSB26-66 and APSB26-69). It points to an area worth watching, but it does not prove the whole component is defective.

How do you know if you are exposed?

1. Inventory ACC instances, including test and staging, and note their build number.
2. Compare with build 9398. Anything lower needs fixing.
3. Check whether the instance is reachable from the Internet (partner integration, web console, tracking interfaces).
4. For hybrid deployments, identify the components that remain on your side.

How do you detect a compromise?

Adobe reports no exploitation, but the window between an advisory and the first attacks is often measured in days for a maximum score. Look for:

• unusual child processes launched by Campaign services;
• new operator accounts or permission changes;
• modified workflows, delivery templates or recurring campaigns (a plausible persistence route on this kind of platform);
• subscriber list exports outside usual hours;
• unexpected outbound connections from the server.

How do you fix it?

1. Install build 9398 or later on every affected instance.
2. Remove Internet exposure of the console and of interfaces that do not need it, or place them behind an authenticating gateway.
3. Rotate secrets stored in the platform (connection strings, SMTP credentials, API keys) if the instance was exposed before the fix. The file-read capability of CVE-2026-48448 makes this a prudent reflex.
4. Apply least privilege to the system account running Campaign.

Why does a 10.0 score change patch priority?

A 10.0 score means no precondition protects the instance: no account, no click, network access is enough, and the changed scope indicates the impact extends beyond the vulnerable component. In practice this level puts the fix ahead of the usual maintenance calendar. If an instance is exposed to the Internet and cannot be updated immediately, the most useful fallback is to cut external network access until the fix lands, then document the decision and the date it is lifted. Adobe classed the bulletin as Priority 1, which supports this reading.

What changes when an AI agent has access to this system?

A campaign platform holds exactly what an attacker wants: recipient lists, message templates and a trusted delivery channel. When an AI agent has access, the risk changes nature.

• Credentials in context. An agent that prepares or sends campaigns holds a token or operator account. If the model can read that secret (environment variable, config file, diagnostic tool), a prompt injection can make it leak. This is the sensitive information disclosure OWASP describes as LLM02.
• Automatic actions at scale. An agent allowed to create or launch a delivery can be led, by a booby-trapped message or document it reads, to send attacker-chosen content to the whole database. Without human approval before sending, the mistake cannot be recalled. This is the typical excessive agency case (LLM06).
• The agent as a relay for a compromise. On a vulnerable instance, an attacker needs no prompt: they run code. But if the agent is hosted on the same machine or has internal network access from it, compromising the server gives access to its tools, its model keys and the systems it drives.
• Insufficient logging. Logs of a campaign launched by an agent look like those of a legitimate operator. Without a record of the instructions received and tool arguments, reconstruction is hard.

Useful measures: dedicated agent accounts with limited rights (draft without send), human approval before any send, volume caps, and a check of recipients and templates by a layer independent of the model. See our pages on AI agent security and prompt injection.

How do you test this risk on your agent?

An agent test looks for what an attacker can make it do with the real access it was given: secret reads, unapproved sends, data exports. The Agent Red Team Express does this in 5 days for 1,900 EUR, with reproducible evidence. The discovery call, 30 minutes and free, is there to list the email campaigns your agent can launch or modify.