Adobe Campaign Classic CVE-2026-48449: a perfect 10.0 RCE in enterprise marketing
> In short: CVE-2026-48449 is a maximum-severity incorrect authorization flaw in Adobe Campaign Classic (ACC), scored at CVSS 10.0 — the perfect score. It allows arbitrary code execution in the context of the current user, without any user interaction. A companion flaw, CVE-2026-48448 (SQL injection, CVSS 8.6), enables arbitrary file reads. Both fixed in ACC v7 build 9398. Not exploited at disclosure.
Why this matters to you
Adobe Campaign Classic runs the marketing automation backend for a large share of enterprise organizations — the same enterprises that buy your SaaS. If a client uses ACC to send payroll notifications, onboarding emails, or customer communications, a compromise there gives the attacker a trusted channel straight into your users' inboxes.
A CVSS 10.0 is the maximum: network-reachable, low complexity, no privileges required, no user interaction, full impact on confidentiality, integrity, and availability. When a 10.0 drops, the operational rule is simple: patch before you do anything else today.
The two flaws
CVE-2026-48449 (CVSS 10.0): Incorrect authorization that results in arbitrary code execution. No user interaction required. An attacker who can reach the ACC instance over the network can execute code with the privileges of the application process.
CVE-2026-48448 (CVSS 8.6): SQL injection that enables arbitrary file reads. An attacker can read sensitive files from the server's filesystem — configuration files, credentials, database connection strings.
Together, the chain is: file read (steal config and credentials) → code execution (compromise the server). Adobe says neither flaw is being exploited in the wild as of the advisory.
What to do
The enterprise marketing pattern
Adobe Campaign Classic joins a pattern we see across enterprise marketing/CRM platforms: they hold trusted communication channels (email, SMS, push), they're exposed for integration, and they have complex permission models that produce authorization flaws. A compromised ACC instance can send phishing emails from your client's legitimate domain, modify delivery content, and exfiltrate subscriber data. For your SaaS vendor security questionnaire: ask whether clients running ACC are patched and whether the instance is internet-exposed.
Building HR, payroll, or recruiting software? CleanIssue performs security audits for HR SaaS in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.
Related articles
Three adjacent analyses to keep exploring the same attack surface.
Adobe ColdFusion CVE-2026-48282: a max-severity RCE exploited within 2 hours of disclosure
A maximum-severity flaw (CVSS 9.8) in Adobe ColdFusion 2025.9, 2023.20 and earlier allows unauthenticated remote code execution. Exploitation started within 2 hours of Adobe's disclosure. ~800 instances exposed online. Fix available.
Fastjson 1.x CVE-2026-16723: a critical RCE with no patch, actively exploited
A CVSS 9.0 remote code execution flaw in Alibaba's Fastjson 1.2.68–1.2.83 lets an unauthenticated attacker run code on affected Spring Boot fat-JAR applications. No AutoType or classpath gadget required. No 1.x patch exists yet. Workaround: SafeMode.
SharePoint CVE-2026-58644: a critical RCE zero-day added to the CISA KEV catalog
A deserialization flaw (CVSS 9.8) in Microsoft SharePoint Server lets an attacker authenticated as Site Owner execute arbitrary code remotely. Actively exploited as a zero-day, added to the CISA KEV catalog on July 16, 2026 with a July 19 remediation deadline.
Sources
Related services
If this topic maps to a real risk in your stack, these are the most relevant CleanIssue audits.