What Adobe patched
On August 1 Adobe disclosed CVE-2026-48449, a maximum-severity flaw in Campaign Classic that earns the full CVSS 10.0 score. Adobe describes it as an incorrect authorization weakness that leads to arbitrary code execution in the context of the current user, and the vector confirms the worst reading: network accessible, low complexity, no privileges, and no user interaction required. The scope is marked as changed, which means a successful exploit can reach beyond the vulnerable component into the wider system.
The fix ships in Campaign Classic v7 as build 7.4.3 (9398) for both Windows and Linux. Adobe bundled a second issue in the same update, CVE-2026-48448, a SQL injection flaw scored 8.6 that permits arbitrary file reads. Neither vulnerability has a workaround. The only remediation Adobe offers is the patched build, so any team running an older on-premises or hosted Campaign Classic instance is exposed until it applies the update.
Why a marketing platform is a serious target
Campaign Classic is the engine many retail and commerce brands use to run cross-channel campaigns, which means it holds email lists, segmentation data, and the personalization attributes that describe individual customers. A platform that can send to millions of recipients and reads from the systems that feed it is a high-value pivot point. Arbitrary code execution there is a direct route to customer PII and to whatever databases and connectors the platform is trusted to query, which places it well beyond the category of a marketing inconvenience.
We keep seeing security programs treat marketing and creative tooling as second-tier assets that live outside the core patch cadence. That assumption is now expensive. A CVSS 10.0 in the campaign platform sits at the same risk tier as a flaw in your identity provider or your database, and it deserves the same emergency handling. If marketing operations runs its own instance outside IT governance, this bulletin is the argument for pulling it back under the same vulnerability management umbrella.
The authorization pattern that keeps recurring
Incorrect authorization is the common thread through this release. The Campaign Classic flaw is one, and several of the eight critical Bridge vulnerabilities Adobe patched in the same cycle also stem from incorrect authorization leading to code execution or privilege escalation. This is the class of bug where the software checks that an action is possible without properly checking that the requester is allowed to perform it. It is unglamorous, it is easy to miss in review, and it produces some of the highest-impact outcomes.
For architects the lesson is about defense in depth around these platforms rather than trust in the vendor's access model. Network segmentation that keeps Campaign Classic off the open internet, tight egress controls, and least-privilege service accounts all reduce the blast radius when an authorization check fails. None of that replaces the patch. It buys time and it limits how far an attacker travels once a single control gives way.
No known exploitation is a clock, not a reprieve
Adobe states plainly that it is not aware of any of the flaws being exploited in the wild. That is genuinely good news and it is also the least durable fact in the advisory. The moment a patch ships, capable actors diff the fix to reconstruct the vulnerability, and a CVSS 10.0 with no user interaction is exactly the profile that draws that effort. The gap between disclosure and working exploit for a bug this clean is often measured in days.
So the honest way to read the exploitation status is as a countdown that started when the bulletin published. Enterprises that patch inside this window pay a planned maintenance cost. Enterprises that wait inherit the risk of being caught by the first opportunistic scan once proof-of-concept code circulates. The researchers credited on the Bridge fixes, working under the handles kaiksi and yjdfy, are a reminder that plenty of skilled eyes are already looking at Adobe's attack surface.
Where this fits in the patch queue
For a CTO triaging the week, CVE-2026-48449 belongs at the top. The scoring, the lack of a workaround, and the sensitivity of the data behind Campaign Classic combine into a straightforward emergency-change case. The first task is inventory: confirm every Campaign Classic instance, including any that marketing or an agency stood up outside the central estate, then verify each is on build 7.4.3 (9398) or later. Hosted and managed deployments should get written confirmation from the provider that the fix is applied.
The Bridge flaws are lower urgency but not optional, since eight critical issues on creative workstations expand the endpoint attack surface for the teams handling brand assets. Roll those into the standard endpoint patch cycle and confirm coverage across every machine, including contractor and agency laptops that touch your asset pipeline. The through-line for the roadmap is that marketing and creative platforms carry real data and real reach, and they need to be treated as production systems with production-grade patch discipline rather than as departmental tools.
The shadow-IT problem this exposes
The hardest part of responding to this bulletin is usually finding every instance to patch in the first place. Marketing organizations have a long history of standing up campaign tooling on their own budget, sometimes through an agency, sometimes on a cloud instance that never appears in the central asset register. A CVSS 10.0 flaw is unforgiving of that gap, because an unmanaged Campaign Classic server is exposed for exactly as long as nobody remembers it exists. The teams most at risk are the ones who cannot answer, with confidence, how many instances they run.
This is the moment to close that gap for good rather than only for this CVE. Reconcile your vendor spend against your asset inventory, because a line item for Adobe Campaign is a strong signal that an instance exists somewhere. Bring any orphaned deployment under central identity, logging, and patch management, or retire it. The next maximum-severity flaw in a marketing platform is a question of when, and the enterprises that already know their full footprint will patch in hours while the rest spend those hours searching.
