Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction

Summary: Adobe released updates for a maximum-severity flaw in Campaign Classic, tracked as CVE-2026-48449 with a CVSS score of 10.0, described as incorrect authorization that could allow arbitrary code execution in the context of the current user without any user interaction. The same update fixes a high-severity SQL injection flaw, CVE-2026-48448 at CVSS 8.6, that could enable arbitrary file reads, and Adobe said it is not aware of either being exploited in the wild; both are addressed in ACC v7 7.4.3 build 9398 for Windows and Linux.
Key Takeaway: A 10.0 that needs no user interaction means an unpatched Campaign Classic instance can be compromised without anyone clicking anything, and the paired SQL injection flaw opens arbitrary file reads on the same system.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-48374 CVE-2026-48390 CVE-2026-48391 CVE-2026-48392 CVE-2026-48393 CVE-2026-48394 CVE-2026-48395 CVE-2026-48396 CVE-2026-48448 CVE-2026-48449
Related: ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks Cyber Risks ·
Adobe Patches Three CVSS 10.0 Cold Fusion and Campaign Classic Flaws Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026