# Adobe Campaign Classic Hit by CVSS 10.0 Authorization Flaw — Arbitrary Code Execution, No User Interaction Required

## The Threat

Adobe has patched a maximum-severity vulnerability in Campaign Classic (ACC), the company's enterprise marketing automation platform used by major brands to run large-scale email, SMS, and cross-channel campaigns. The flaw, CVE-2026-48449, scores a perfect 10.0 on the CVSS scale — a rating reserved for vulnerabilities that are remotely exploitable, require no credentials, need no victim interaction, and carry the potential for complete system compromise.

At its core, the issue is an incorrect authorization flaw: the application fails to properly verify whether a requestor has the right to perform certain privileged operations. In practice, that means an unauthenticated attacker who can reach the ACC server over the network could trigger arbitrary code execution — effectively taking full control of the underlying system without ever logging in or tricking a user into clicking anything.

What makes this particularly significant is the context in which ACC operates. This isn't a consumer app or a dev tool — it's a production backend that sits inside enterprise networks, often with direct database access to customer contact lists, campaign records, and marketing analytics pipelines. A server-side compromise here doesn't just mean one machine; it means a potential pivot point into broader enterprise infrastructure and, depending on how the platform is deployed, access to personally identifiable information for potentially millions of end customers.

## Severity and Impact

| Field | Detail |
|---|---|
| **CVE** | CVE-2026-48449 |
| **CVSS Score** | 10.0 (Critical) |
| **Vector String** | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| **Attack Vector** | Network |
| **Attack Complexity** | Low |
| **Privileges Required** | None |
| **User Interaction** | None |
| **CWE** | CWE-863 — Incorrect Authorization |
| **Impact** | Arbitrary code execution on the ACC server |

A CVSS 10.0 is not handed out lightly. All three impact dimensions — confidentiality, integrity, and availability — are rated High, and the scope is marked Changed, meaning a successful exploit can break out of the vulnerable component and affect resources beyond it. There is no meaningful mitigating factor in the base score.

## Affected Products

- **Adobe Campaign Classic (ACC)** — enterprise marketing automation platform
  - Specific affected version ranges are detailed in Adobe's official security bulletin (APSB reference)
  - Both on-premises and potentially hybrid-hosted deployments should be treated as affected until vendor confirmation otherwise

*Consult Adobe's published advisory for the exact build numbers and patch matrix before assuming scope.*

## Mitigations

**Immediate action:**

- Apply Adobe's security update as soon as possible — given the CVSS 10.0 rating and zero user-interaction requirement, treat this as an emergency patch, not a scheduled maintenance item
- Check Adobe's security bulletin for the specific patched version and update ACC installations accordingly

**If patching is not immediately possible:**

- Restrict network access to the ACC application server using firewall rules or network ACLs — limit inbound connections to known, trusted IP ranges only
- Place ACC behind a reverse proxy or WAF configured to block unexpected request patterns to administrative or API endpoints
- Audit current exposure: identify any ACC instances accessible from the public internet or from untrusted internal network segments
- Enable enhanced logging on ACC servers and monitor for anomalous request patterns, unexpected process spawns, or outbound connections from the ACC process

**Longer-term hardening:**

- Review ACC deployment architecture and enforce least-privilege network segmentation — the server should only be reachable by systems that genuinely need to reach it
- Ensure ACC service accounts run with minimal OS-level privileges so that even a successful exploit has limited lateral movement options
- Verify that database credentials used by ACC follow the principle of least privilege

## References

- Adobe Security Bulletin for Campaign Classic — [https://helpx.adobe.com/security/products/campaign.html](https://helpx.adobe.com/security/products/campaign.html)
- Adobe Campaign Classic product page — [https://business.adobe.com/products/campaign/campaign-classic.html](https://business.adobe.com/products/campaign/campaign-classic.html)
- NVD entry for CVE-2026-48449 — [https://nvd.nist.gov/vuln/detail/CVE-2026-48449](https://nvd.nist.gov/vuln/detail/CVE-2026-48449)
- CWE-863: Incorrect Authorization — [https://cwe.mitre.org/data/definitions/863.html](https://cwe.mitre.org/data/definitions/863.html)

---

## HackWire Analysis

A CVSS 10.0 in enterprise marketing software should get more attention than it typically does. The security industry tends to fixate on network perimeter tools, VPNs, and identity providers when thinking about critical-severity vulnerabilities — but platforms like Adobe Campaign Classic represent a category of high-value target that's often poorly monitored and slow to patch.

Here's the uncomfortable reality: ACC installations are frequently managed by marketing operations teams, not security teams. Patch cycles for marketing automation platforms tend to follow a different cadence than, say, a VPN concentrator or a firewall. In many enterprise environments, the ACC server is treated as a business application — something the marketing team owns — rather than a security-relevant system that needs emergency response procedures. That organizational gap is exactly the kind of thing threat actors have learned to exploit.

The incorrect authorization primitive here is also worth dwelling on. CWE-863 flaws don't typically appear in isolation — they suggest that somewhere in the authorization model, the application either trusts data it shouldn't, skips a check it should make, or exposes privileged functionality without adequate gating. In complex platforms like ACC, which expose rich APIs for campaign management, workflow automation, and data integration, the attack surface for this class of bug is substantial.

The no-user-interaction, no-authentication profile means this is exactly the kind of vulnerability that shows up in opportunistic scanning campaigns within days of public disclosure. Organizations running on-premises ACC instances with any degree of external exposure should treat this as a fire drill. Check whether ACC is internet-facing, restrict access now, and patch before the weekend.

Vendors and buyers of enterprise marketing platforms should also read this as a signal: these systems carry real security weight, and they deserve real security investment — both in the development process and in how customers are supported through vulnerability response.

— HackWire Editorial

---

## Related Coverage

- Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
- Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
- Stay current via the [HackWire homepage](https://www.hackwire.news/)