Adobe fixes critical flaw scoring 10.0 in Campaign Classic

Adobe published security bulletin APSB26-114 on 29 July 2026 for Adobe Campaign Classic, the platform organisations use to manage and automate cross channel marketing campaigns. The bulletin fixes two vulnerabilities. CVE-2026-48449 is an incorrect authorisation flaw scoring 10.0, and can let an attacker without login execute arbitrary code. CVE-2026-48448 is an SQL injection scoring 8.6, which can give an attacker without login read access to files. The bulletin applies to fully on premise installations and to the on premise parts of hybrid deployments, in version 7.4.3 build 9397 or earlier, and the fix sits in build 9398. Adobe states that instances it hosts itself have already been remediated, and that it was not aware of exploitation in the wild when the bulletin was published.

What happens technically

NVD records the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H for CVE-2026-48449, and classifies the weakness as CWE-863, incorrect authorisation. The vector explains why the number reaches the ceiling. The attack happens over the network, it requires no privileges, it requires no user action, and the scope changes, meaning the flaw has consequences beyond the component where it sits. Incorrect authorisation as a weakness class means the system does check who is asking, but not whether they are allowed to have what they asked for. Adobe marked the update as priority 1, the category it uses for updates that should be installed promptly.

The second vulnerability is less severe in numbers, yet useful to read alongside the first. NVD classifies CVE-2026-48448 as CWE-89, meaning SQL injection, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. Only confidentiality is affected, and the impact is reading, not modification. SQL injection arises when input from a request ends up inside a database query without being separated from the command itself, and database engines can in many configurations be used to read files from the server. NVD describes exactly that, file system read access and disclosure of sensitive memory. Two such flaws side by side are worth considering together, since reading configuration is the most common way to aim a heavier vulnerability precisely.

What this means for you if you host Campaign Classic yourself

What separates this case from an ordinary server vulnerability is what your platform holds. Campaign Classic runs your customer communication, and the database behind it is usually full of personal data, meaning names, email addresses, mobile numbers, consents and often purchase and behavioural history. A breach here is therefore a breach of the security of processing under GDPR Article 32, with a duty to notify the supervisory authority within 72 hours where rights and freedoms are likely to be affected. We would argue that the severity is not measured in CVSS alone, but in the number of data subjects sitting in that database.

The second distinctive trait is who owns the platform inside your own organisation. Campaign Classic is bought and run by the marketing department in many organisations, while patching is something IT does. The bulletin then falls between two chairs, and nobody knows the build number. The line Adobe draws between instances it hosts and installations the customer hosts makes that the first question you have to answer. Our assessment is that you should treat the update as an emergency change. Bring in the data protection officer early, so that the notification question is not settled after a log review that should have happened first.

Berigo recommends

• Establish whether you run a Campaign Classic installation yourselves, and read off the build number.
• Update to build 9398, and treat it as an emergency change.
• Check whether the interface is reachable from the internet, and restrict access to what is necessary.
• Review logs for unexpected queries and calls, and preserve the logs before they rotate.
• Bring in the data protection officer, since the platform holds personal data at scale, and assess the notification duty if the review shows traces.