News Date: 2026-08-01
Adobe has released an urgent security update for Campaign Classic after correcting a maximum-severity vulnerability that could allow an attacker to execute arbitrary code. Campaign Classic is used by enterprises to manage customer communications and marketing campaigns, placing it close to valuable databases, customer records, messaging infrastructure, and internal business workflows.
A Serious Authorization Failure
The primary vulnerability, CVE-2026-48449, carries a CVSS score of 10.0. Adobe described it as an incorrect authorization issue capable of producing code execution in the context of the affected user without requiring user interaction.
The update also addresses CVE-2026-48448, a high-severity SQL injection vulnerability with a CVSS score of 8.6. Successful exploitation could allow an attacker to read arbitrary files from the underlying system. In a real enterprise environment, that may expose configuration files, credentials, integration secrets, database connection details, or other information that could support a broader intrusion.
Adobe has fixed both vulnerabilities in Campaign Classic version 7.4.3 build 9398 for Windows and Linux. The company said it was not aware of exploitation in the wild when the advisory was issued, but the absence of observed attacks should not be treated as evidence that vulnerable systems are safe.
Recommended Response
- Identify every Campaign Classic deployment, including development, staging, and disaster recovery systems.
- Upgrade Windows and Linux installations to version 7.4.3 build 9398 or a later supported release.
- Confirm that internet access to administrative and application interfaces is limited to necessary users and networks.
- Review logs for unusual queries, file access, process creation, account changes, or outbound connections.
- Rotate sensitive credentials if suspicious activity is found or if the platform handled secrets accessible to its service account.
Marketing Platforms Are High-Value Infrastructure
I believe organizations frequently underestimate the security importance of marketing technology. These systems may not look as critical as identity servers or financial databases, but they often contain extensive customer information and trusted connections to email, analytics, cloud storage, and customer relationship management platforms.
The severity score should attract attention, but context remains essential. Security teams should determine whether the platform is externally reachable, what privileges its service accounts possess, and which connected systems could be affected. Patching is the immediate requirement, while segmentation and least-privilege integration design provide the longer-term protection.