Adobe Campaign Classic Incorrect Authorization Enables RCE
Incorrect authorization flaw in Adobe Campaign Classic scores CVSS 10.0, enabling unauthenticated remote code execution without user interaction. Adobe has patched.
- Vendor
- Adobe
- Product
- Campaign Classic
- CVSS
- 10.0
- EPSS (exploit probability)
- 0.9%
- Status
- patched
- Published
Is CVE-2026-48449 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-48449 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.9% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-48449 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Adobe Campaign Classic (ACC), Adobe’s enterprise marketing automation platform, contains a maximum-severity incorrect authorization vulnerability that allows an unauthenticated network attacker to execute arbitrary code without any user interaction.
The flaw is classified under incorrect authorization (CWE-285 / related class): software fails to verify that a requestor is entitled to access a resource or invoke an action. At CVSS 10.0, exploitation requires no privileges and no victim interaction — the attack surface is the network.
Adobe released security updates on August 1, 2026. Affected version ranges and the full Adobe security bulletin are available through Adobe’s PSIRT advisories. The NVD entry links to advisory details as they are published.
Exploitation status: No confirmed active exploitation reported at time of writing. CVE-2026-48449 is not listed in CISA’s Known Exploited Vulnerabilities catalog as of publication.
What to do: Apply the available Adobe security update immediately. Organizations using Campaign Classic through a managed service provider should confirm patch status with their provider rather than assuming it has been applied.
For full technical advisory details, see the NVD record and The Hacker News coverage.
Other Adobe CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerabilitywrite-up | [ CRITICAL ] | 9.6 | 47.5% | |
| CVE-2026-71362 Incorrect Authorization in Adobe Commerce and Magento Open Sourcewrite-up | [ CRITICAL ] | 9.1 | 91.7% | |
| CVE-2026-75650 Adobe Commerce and Magento Template Engine Injection (StyleSmuggler)write-up | [ CRITICAL ] | 10.0 | 99.4% | |
| CVE-2026-48294 Adobe Acrobat Chrome extension cross-context WhatsApp data access (HermeticReader)write-up | [ HIGH ] | 7.4 | 1.9% | — |
| CVE-2026-48325 Adobe ColdFusion missing authentication — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.6% | — |
| CVE-2026-48322 Adobe ColdFusion code injection — CVSS 9.6write-up | [ CRITICAL ] | 9.6 | 1.2% | — |
| CVE-2026-48321 Adobe ColdFusion authorization bypass — CVSS 9.3write-up | [ CRITICAL ] | 9.3 | 0.4% | — |
| CVE-2026-48319 Adobe ColdFusion path traversal — CVSS 9.1write-up | [ CRITICAL ] | 9.1 | 1.4% | — |
