Adobe Campaign Classic

CVE-2026-48449 is an Incorrect Authorization (CWE-863) vulnerability in Adobe Campaign Classic (ACC) v7, affecting on-premise deployments running version 7.4.3 build 9396 and earlier. The flaw allows an unauthenticated remote attacker to bypass authorization checks entirely and achieve arbitrary code execution in the context of the current user — with scope change, meaning the attacker can pivot beyond the vulnerable component. ACC's architecture includes an Apache Tomcat-based web module and tracking/redirection server that are internet-facing by design (placed in the DMZ to handle email click-tracking, landing pages, and unsubscribe links). The affected surface is therefore directly reachable from the internet in most on-premise deployments.

Adobe rated this a perfect 10.0 — the maximum possible CVSS score — and that rating is *technically accurate* for the attack mechanics: network-reachable, no auth, no user interaction, full CIA impact with scope change. However, noisgate downgrades to HIGH 9.0 because ACC is a niche line-of-business marketing platform, not a high-value infrastructure component (it is not an identity provider, domain controller, hypervisor, or backup server). The on-premise installed base is a fraction of all enterprises, Adobe-hosted and hybrid-hosted instances are already patched server-side, there is no public PoC, no active exploitation, and EPSS sits at a low 0.54%. That said, the downgrade is modest — ACC servers hold massive customer PII (email addresses, demographics, purchase history), so a breach carries significant regulatory and reputational consequences. With related Adobe ColdFusion CVEs (CVE-2026-48282) already under active exploitation, threat-actor interest in Adobe product vulns is elevated right now.

Why this verdict

• Unauthenticated network RCE with scope change: The CVSS vector is maximum severity — no auth, no interaction, scope change to OS/database. Any attacker with network access to the ACC web module gets code execution. This alone justifies HIGH or above.
• Internet-facing by design: ACC's tracking/redirection server and web module are architecturally placed in the DMZ. Unlike many enterprise apps that *can* be segmented away, ACC *must* be reachable from the internet for email tracking and landing pages, making the attack surface directly exposed.
• Role multiplier: ACC occupies a *line-of-business marketing server* role. In this role, the blast radius is host → tenant → customer PII database (mass data egress of regulated personal data). It does NOT reach domain → fleet → supply-chain scale. ACC is not canonically a high-value-role component (not IdP, DC, hypervisor, backup, CI/CD, or network edge). The floor rule does not mandate CRITICAL.
• Temporal friction: No public PoC, no active exploitation, EPSS at 0.54%. These are temporal factors that could shift rapidly — especially given that related Adobe ColdFusion CVEs from the same patch cycle ARE being exploited, indicating active attacker interest in Adobe product vulnerabilities right now.
• Reduced population: Only on-premise ACC v7 deployments are affected. Adobe-hosted and hybrid-hosted instances have been patched server-side. This narrows the vulnerable population significantly.

Why not higher?

A CRITICAL rating would be warranted if ACC were a high-value infrastructure component where compromise leads to fleet-scale or identity-scale impact (domain controller, hypervisor, IdP, backup). ACC is a marketing automation server — significant for PII exposure and regulatory risk, but the blast radius is bounded to the ACC server, its connected databases, and potentially the DMZ network segment. The absence of active exploitation, public PoC, and KEV listing further supports keeping this one notch below CRITICAL.

Why not lower?

Dropping below HIGH would be irresponsible given the perfect CVSS 10.0 mechanics: unauthenticated, network-reachable, no user interaction, with scope change. ACC servers are internet-facing by design and contain regulated customer PII. Related Adobe CVEs are already under active exploitation, and Adobe assigned Priority Rating 1. The temporal calm (no PoC, no exploitation) is fragile and could break any day.

1. Restrict network access to ACC web endpoints immediately — Place ACC behind a WAF with strict allowlisting of known IP ranges (ESPs, internal admin IPs). Block all unauthenticated access to SOAP/API endpoints. If tracking functionality must remain public, restrict to only the /r/ redirection and /res/ resource paths. Deploy within the noisgate HIGH mitigation SLA of 30 days — but given the 10.0 CVSS and Adobe Priority 1 rating, aim for days not weeks.
2. Apply ACC v7.4.3 build 9397 patch — This is the vendor fix. On-premise ACC administrators should apply build 9397 as the definitive remediation. Test in staging first given ACC's tight coupling with marketing databases and delivery workflows.
3. Enable EDR monitoring on ACC servers — Ensure EDR agents are deployed and actively monitoring the ACC application server. Alert on anomalous child processes spawned by Tomcat/nlserver, unexpected outbound connections, and bulk database queries.
4. Audit ACC database credential scope — Verify that ACC's database connection uses least-privilege credentials. The scope-change aspect of this CVE may allow OS-level pivot to database access — limiting DB permissions reduces blast radius.
5. Monitor outbound email volume from ACC — A compromised ACC server could be weaponized to send phishing emails from your trusted sender reputation. Set up alerts for abnormal email volume or recipient patterns.

Run this script on each on-premise ACC server (Linux) or adapt the nlserver path for Windows. Requires shell access to the ACC host with read permissions on the nlserver binary. Example: chmod +x check_acc_cve.sh && ./check_acc_cve.sh

#!/bin/bash
# CVE-2026-48449 / APSB26-69 — Adobe Campaign Classic build check
# Run on the ACC application server. No elevated privileges needed.
# Outputs: VULNERABLE / PATCHED / UNKNOWN

PATCHED_BUILD=9397

# Try to get ACC build number from nlserver
if command -v nlserver &>/dev/null; then
  VERSION_OUTPUT=$(nlserver -version 2>&1)
elif [ -x /usr/local/neolane/nl*/bin/nlserver ]; then
  VERSION_OUTPUT=$(/usr/local/neolane/nl*/bin/nlserver -version 2>&1)
else
  echo "UNKNOWN — nlserver binary not found. Verify this is an ACC server."
  exit 2
fi

# Extract build number (format: "Adobe Campaign Classic vX.Y.Z build NNNNN")
BUILD_NUM=$(echo "$VERSION_OUTPUT" | grep -oP 'build\s+\K[0-9]+')

if [ -z "$BUILD_NUM" ]; then
  echo "UNKNOWN — could not parse build number from: $VERSION_OUTPUT"
  exit 2
fi

echo "Detected ACC build: $BUILD_NUM (patched build: $PATCHED_BUILD)"

if [ "$BUILD_NUM" -ge "$PATCHED_BUILD" ]; then
  echo "PATCHED — ACC build $BUILD_NUM >= $PATCHED_BUILD. CVE-2026-48449 is remediated."
  exit 0
else
  echo "VULNERABLE — ACC build $BUILD_NUM < $PATCHED_BUILD. Apply ACC v7.4.3 build 9397 immediately."
  exit 1
fi

Sources

1. Adobe Security Bulletin APSB26-69
2. BleepingComputer — Adobe patches seven max severity ColdFusion, Campaign flaws
3. SecurityWeek — Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities
4. The Hacker News — Adobe Patches 7 CVSS 10.0 Flaws
5. Field Effect — Exploitation reported following Adobe security updates
6. BeyondMachines — Adobe Patches Seven Maximum-Severity Flaws
7. Canadian Centre for Cyber Security — Adobe advisory AV26-647
8. Adobe Campaign Classic Architecture Documentation