What the flaw actually does
CVE-2026-48449 is an incorrect authorization vulnerability in Adobe Campaign Classic that lets an attacker execute arbitrary code in the context of the current user, with no interaction required from anyone on the victim side. A CVSS 10.0 score is reserved for the small set of flaws that combine network exploitability, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. This one qualifies on every dimension.
Adobe patched the issue alongside CVE-2026-48448, a high-severity SQL injection bug rated 8.6 that allows arbitrary file system reads through the same product. The two flaws together give an attacker a plausible chain: read sensitive files through the injection bug, then leverage the authorization flaw to execute code directly on the server. Adobe's advisory states the update "addresses critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read," language that covers both issues in a single sentence but understates how dangerous they are in combination.
Why on-premise deployment makes this worse
Campaign Classic is Adobe's on-premise marketing automation platform, run by companies that manage customer email, SMS, and direct mail campaigns from infrastructure they control themselves rather than a SaaS instance Adobe patches on their behalf. That architecture puts the entire patch timeline in the customer's hands: there is no vendor-side mitigation buying time, and every day between disclosure and an organization's own patch deployment is a day the maximum-severity flaw sits live on infrastructure that already holds substantial customer data.
The affected versions are anything prior to 7.4.3 build 9398 on both Windows and Linux, which given the platform's install base likely spans a meaningful number of enterprise retail, financial services, and consumer brand deployments still running older builds because marketing infrastructure upgrades rarely get the same urgency as core business systems. Adobe says it has no evidence of active exploitation yet, but that status changes quickly once proof-of-concept details or reverse-engineered patches start circulating in researcher and attacker communities alike, and history with prior maximum-severity Adobe flaws suggests working exploits tend to surface within days rather than weeks of a patch release.
Marketing platforms are a blind spot in most patch programs
Ask most CTOs to name their top ten systems by patch priority and Campaign Classic will not make the list, even though it typically holds full customer contact databases, campaign history, and often integrates with CRM and e-commerce systems to pull purchase and behavioral data. Security teams tend to organize patch cadence around what looks like core infrastructure: identity providers, VPN appliances, hypervisors, CI/CD tooling. Marketing automation gets folded into a general "business applications" bucket that moves on a slower, less urgent cycle.
That categorization was never really justified and this disclosure makes the gap explicit. A marketing platform that sits inside the corporate network, holds customer PII, and can now be remotely compromised with zero interaction deserves the same priority as any system meeting that same risk profile, regardless of the label attached to its product category. Organizations that inventory their attack surface by system type rather than by data sensitivity and network position are going to keep missing exactly this kind of gap, and Campaign Classic's CVSS 10.0 rating is as strong a data point as any for making the case to reclassify it.
The Bridge patches compound the workload
Adobe shipped this Campaign Classic fix in the same cycle as patches for eight critical vulnerabilities in Adobe Bridge, its digital asset management tool, with CVSS scores ranging from 7.8 to 8.6 covering privilege escalation and code execution. Bridge runs on a huge number of creative and marketing workstations, meaning security teams now have two separate Adobe products, with very different deployment footprints and threat models, requiring urgent attention in the same week.
That kind of clustering is common with large vendors doing coordinated disclosure across a product family, but it strains patch teams that were not planning for two urgent Adobe cycles simultaneously. Treating this as a single "patch Adobe" ticket risks under-resourcing one product while the other gets attention, when both need independent verification that the fix actually deployed across every instance, not just the ones patch management software reports as compliant.
What to do this week
If your organization runs Campaign Classic on-premise, confirm every instance is running 7.4.3 build 9398 or later, including the ones your asset inventory happens to track poorly. Marketing operations teams frequently stand up test, staging, or regional instances that fall outside central IT's visibility, and those shadow deployments are exactly the ones an attacker will find first when scanning for the vulnerable version signature. Ask your marketing and revenue operations teams directly for a list of every Campaign Classic instance they know about, because the answer will likely be longer than what your CMDB shows.
More broadly, this is a good prompt to pull your full Adobe on-premise footprint, Campaign Classic and Bridge both, into the same emergency patch tier you would use for a network-facing zero-day, because that is functionally what this is. Use the moment to ask a harder structural question too: which other systems in your environment are categorized as low-priority business applications purely by habit, holding customer data and network access that would justify a much higher priority if anyone re-evaluated the classification today. A CVSS 10.0 flaw in a system nobody was watching closely is the cheapest reminder you will get that the categorization was wrong.
