Adobe Campaign Classic Hit by a Second CVSS 10.0 RCE (CVE-2026-48449) — and Last Month's Patch Is the Vulnerable Build

Adobe has patched a second maximum-severity remote-code-execution flaw in Adobe Campaign Classic in barely a month, and the build math is the part worth acting on: the version that closed July's bug is the version this one breaks. CVE-2026-48449 is an incorrect authorization flaw that carries a CVSS 3.1 base score of 10.0 and can lead to arbitrary code execution against on-premise Campaign Classic servers without user interaction. If your team applied the Campaign Classic patch three weeks ago and closed the ticket, you're still exposed. Patch again — to build 9398.

Campaign Classic (ACC) is Adobe's on-premise marketing-automation platform: the system enterprises use to run large email and cross-channel campaigns, which means it typically sits on top of sizable customer and subscriber databases. Adobe says it isn't aware of any exploitation yet, and as of this writing the flaw isn't on CISA's Known Exploited Vulnerabilities (KEV) catalog. But a network-reachable 10.0 that needs no privileges and no click, on a data-rich enterprise server, is the exact profile attackers move on quickly — and the remedy here is a single build number.

What Adobe Fixed

Adobe published bulletin APSB26-114 on July 29, 2026, with its top "priority 1" rating. It closes two flaws:

• CVE-2026-48449 — incorrect authorization (CWE-863) leading to arbitrary code execution. Critical, CVSS base score 10.0, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. As The Hacker News notes, Adobe describes it as code execution "in the context of the current user" that needs no user interaction to trigger.
• CVE-2026-48448 — a SQL injection flaw (CWE-89) that can be used for arbitrary file-system reads. High severity, CVSS 8.6. Same fix.

The CVSS vector is the whole prioritization argument in one line: AV:N (reachable over the network), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction), with a changed scope and high impact to confidentiality, integrity, and availability. That combination is what produces a perfect 10.0, and it's why Adobe rates the update priority 1 rather than leaving it to the next maintenance window.

One scoping detail matters. Per Adobe, the bulletin applies only to fully on-premise Campaign Classic deployments and to the on-premise components of hybrid deployments. Adobe-hosted instances were already remediated and need no customer action. SecurityWeek and BleepingComputer report the same split. So the population at risk is specifically the organizations running their own ACC servers.

Why Build 9397 Is the Trap

Here's the piece that isn't in the vendor advisory, and it's the reason this update deserves more urgency than "another Adobe patch." Roughly a month ago, Adobe fixed CVE-2026-48286, a near-identical CVSS 10.0 incorrect-authorization RCE in Campaign Classic. That flaw affected ACC v7 7.4.3 build 9396 and earlier, and the fix was build 9397. The new flaw, CVE-2026-48449, affects ACC v7 7.4.3 build 9397 and earlier, fixed in build 9398.

Read those two lines together: the build that remediated July's maximum-severity bug is the vulnerable ceiling for this one. My read is that any team that treated the earlier patch as "done" and hasn't looked since is now sitting on an unpatched 10.0 while believing it's covered. That's a worse position than being a build behind on a low-severity fix, because the mental model says "we already handled the Campaign Classic emergency." The fix number changing by one digit is easy to miss and expensive to skip.

The versions to check against:

• Affected: Adobe Campaign Classic v7: 7.4.3 build 9397 and earlier (Windows and Linux).
• Fixed: Adobe Campaign Classic v7: 7.4.3 build 9398 (Windows and Linux).

Confidence: confirmed. Both build numbers come from Adobe's bulletins (APSB26-114 for the current fix; the July advisory for the earlier one), corroborated by The Hacker News.

What Defenders Should Do Now

The action list is short and doesn't depend on any open question resolving first:

• Inventory your ACC instances. Identify every on-premise Campaign Classic server, including the on-premise pieces of hybrid setups. If you're fully Adobe-hosted, you're already covered and can stop here.
• Confirm the exact build, not "we patched." Anything at 7.4.3 build 9397 or earlier is vulnerable. Because 9397 was last month's fix, verify the running build directly rather than trusting the prior ticket.
• Apply build 9398. It closes both CVE-2026-48449 and the SQL-injection read (CVE-2026-48448) in one update.
• Constrain exposure while you patch. A no-auth, network-reachable flaw means the immediate risk surface is anything reachable. Restrict who can reach the ACC server's interfaces to the network segments that genuinely need them.
• Watch KEV. It isn't listed today. Given the profile, a KEV addition would be the signal to move from "priority patch" to "drop everything" — the pattern we tracked on the Arista VeloCloud CVSS 10.0 zero-day, where a KEV listing arrived with a short federal clock.

Where This Fits Adobe's Recent Run

This is the latest entry in a busy stretch for Adobe's enterprise products. The company has been shipping back-to-back critical fixes across ColdFusion, including a maximum-severity ColdFusion flaw that moved into active exploitation, and now two Campaign Classic 10.0s in consecutive cycles. Adobe has said it is publishing bulletins twice monthly and attributes the accelerated cadence to AI-assisted vulnerability discovery. The CyberSignal's assessment: for anyone running these products on-premise, the practical takeaway is that "patched last cycle" is no longer a durable state — the review interval for Adobe enterprise servers needs to match the cadence at which new maximum-severity bugs are landing.

What's Not Yet Known

A few items are open, and we're not filling them in. Adobe's bulletin credits outside researchers for the eight Adobe Bridge flaws disclosed the same day but lists no external credit for CVE-2026-48449, which is consistent with an internally found issue — though the advisory doesn't state that outright, so treat attribution as unconfirmed. There's no public technical detail on how the authorization check fails, and The CyberSignal isn't speculating on it or reproducing any exploit path. Exploitation status is "none observed" per Adobe as of publication, and KEV status is "not listed." Both can change; the patch decision doesn't wait on either.

Primary Documents

• Adobe — Security update available for Adobe Campaign Classic | APSB26-114
• The Hacker News — Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
• SecurityWeek — Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities
• BleepingComputer — Adobe patches seven max severity ColdFusion, Campaign flaws