Adobe has issued critical updates to address a high‑severity flaw in its Campaign Classic platform that could allow attackers to execute arbitrary code without user interaction.
Adobe has released critical security updates for its Campaign Classic platform, addressing a flaw that could enable attackers to execute arbitrary code without any user interaction.
The vulnerability, identified as CVE-2026-48449, received a maximum CVSS score of 10.0, indicating the highest level of risk.
Researchers described the issue as a case of incorrect authorization, where privileged actions could be performed by unauthenticated users.
Campaign Classic, an enterprise‑focused marketing automation tool, has been a target for attackers due to its integration with other Adobe Experience Cloud services.
The flaw allows an attacker to craft a specially‑crafted request that bypasses standard permission checks and injects malicious code into the system.
Because the vulnerability does not require any user interaction, it can be exploited remotely, increasing its potential impact.
Adobe recommends that administrators apply the latest patches immediately and review access controls for all Campaign Classic instances.
The company also advises users to monitor for any unusual activity and to verify that all custom scripts are signed and approved.
This update follows a series of security enhancements in Adobe’s Experience Cloud suite, aimed at tightening authorization mechanisms.
Security professionals are urged to assess their current exposure and to conduct a thorough audit of permission settings across their marketing automation environments.
Adobe has released critical security updates for its Campaign Classic platform, addressing a flaw that could enable attackers to execute arbitrary code without any user interaction.
The vulnerability, identified as CVE-2026-48449, received a maximum CVSS score of 10.0, indicating the highest level of risk.
Researchers described the issue as a case of incorrect authorization, where privileged actions could be performed by unauthenticated users.
Campaign Classic, an enterprise‑focused marketing automation tool, has been a target for attackers due to its integration with other Adobe Experience Cloud services.
The flaw allows an attacker to craft a specially‑crafted request that bypasses standard permission checks and injects malicious code into the system.
Because the vulnerability does not require any user interaction, it can be exploited remotely, increasing its potential impact.
Adobe recommends that administrators apply the latest patches immediately and review access controls for all Campaign Classic instances.
The company also advises users to monitor for any unusual activity and to verify that all custom scripts are signed and approved.
This update follows a series of security enhancements in Adobe’s Experience Cloud suite, aimed at tightening authorization mechanisms.
Security professionals are urged to assess their current exposure and to conduct a thorough audit of permission settings across their marketing automation environments.