A CVSS **10.0** flaw that runs code without a click is the most counterintuitive thing about the recent Adobe announcement. The Adobe Campaign Classic vulnerability (CVE‑2026‑48449) lets an attacker execute arbitrary code in the context of the current user, and it doesn’t need any user interaction.
Key Takeaways
- Adobe patched a CVSS **10.0** flaw in Campaign Classic that can execute code without user interaction.
- A second high‑severity SQL‑injection flaw (CVE‑2026‑48448) scored **8.6** and could enable arbitrary file reads.
- Eight critical flaws in Adobe Bridge were also fixed, all ranging from **7.8** to **8.6**.
- Both patches are available in ACC v7: 7.4.3 build 9398 for Windows and Linux.
- Adobe says it hasn’t seen any exploitation in the wild yet.
Historical Context
Adobe’s marketing‑automation suite has been a staple for large enterprises since the early 2010s. Over the years, the product line has accumulated a reputation for deep integrations with CRM, analytics, and email platforms. Those same integrations have historically opened pathways for complex attack surfaces. In 2022, Adobe released a series of security bulletins that addressed several medium‑severity bugs in its campaign tools. Those patches laid groundwork for more strong authorization checks, yet the code paths that handle workflow orchestration remained difficult to audit.
The community‑driven disclosures that surfaced in 2025 highlighted a recurring theme: privilege‑escalation vectors often hide behind “trusted” internal APIs. Researchers — including Kieran (“kaiksi”) and “yjdfy,” who later surfaced in the Bridge disclosures — demonstrated that even well‑reviewed components could contain subtle misconfigurations. Their findings nudged Adobe to adopt a more aggressive patch cadence, culminating in the August 1 2026 release.
That cadence mirrors a broader industry shift. Vendors of enterprise‑grade software have begun treating “no‑click” remote code execution as a top‑priority class of bugs, because the impact curve is steep. When a vulnerability scores a perfect **10.0**, it signals that an attacker can move from a single request to full system compromise without any user prompting. The recent Adobe advisory therefore sits at the intersection of legacy code complexity and modern threat modeling.
Adobe Campaign Classic vulnerability forces urgent patching
On August 1 2026, Adobe rolled out security updates that address the maximum‑severity flaw in its enterprise‑focused marketing automation platform. The vulnerability, tracked as CVE‑2026‑48449, carries a **10.0** CVSS score, meaning it’s as severe as a remote code execution that can be triggered without any user action. That’s the kind of bug that makes every security team sit up and take notice.
How the exploit works
According to Adobe’s advisory, the bug stems from an “incorrect authorization” path that lets an attacker invoke functionality reserved for privileged users. Because the exploit runs in the context of the current user, it can bypass typical sandboxing measures. In practice, a malicious actor could embed a crafted request into a trusted workflow, and the server would dutifully execute the payload.
Severity and why it matters
The CVSS **10.0** rating isn’t just a number; it signals that the flaw can be exploited remotely, without authentication, and without requiring the victim to click anything. That combination is rare and dangerous. It also means that once an attacker gains a foothold, they can move laterally across the network with the same privileges the compromised account holds.
“This update addresses critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read,” Adobe said in its advisory.
Adobe noted that it isn’t aware of any active exploitation, but the mere existence of such a flaw in a product used by large enterprises is enough to merit immediate action. Companies that run Campaign Classic on Windows or Linux should verify they’re on build 9398 of version 7.4.3, as that’s the only release that contains the fixes.
Patch details and rollout timeline
The patches for both CVE‑2026‑48449 and the accompanying CVE‑2026‑48448 are bundled together in the same update. Adobe’s release notes specify the following versions:
- ACC v7: 7.4.3 build 9398 for Windows
- ACC v7: 7.4.3 build 9398 for Linux
Those builds replace the vulnerable components and also harden the underlying authorization checks. The advisory stresses that the update is mandatory for any organization that processes customer data through Campaign Classic, because the platform often integrates with CRM, email, and analytics tools.
Technical Architecture of Campaign Classic
Campaign Classic sits atop a layered architecture. At the base is a web server that receives HTTP requests from internal tools and external services. Above that sits a workflow engine that interprets XML‑based campaign definitions. Those definitions dictate how contact records are filtered, how messages are queued, and which downstream APIs are called. Finally, a data access layer talks to a relational database where campaign metadata and customer attributes reside.
Authorization checks are enforced at the workflow‑engine level. In a healthy deployment, only users with the “campaign‑admin” role can trigger actions that modify the execution graph. The CVE‑2026‑48449 bug bypasses that gate by exploiting an incorrect path in the request router, allowing a regular user to masquerade as an admin. Because the request reaches the execution engine, the malicious payload runs with full privileges.
From a defensive standpoint, the architecture suggests several choke points. Network firewalls can limit exposure of the web endpoint. Application‑level logging can flag unusual workflow submissions. And database auditing can catch unexpected reads or writes after a suspicious request. Yet the perfect‑score CVSS rating tells us that the flaw subverts many of those defenses in a single move.
Adobe Bridge updates: eight critical flaws patched
While the Campaign Classic issue grabbed headlines, Adobe also shipped fixes for eight critical‑rated flaws in Adobe Bridge. Those vulnerabilities, all scoring **7.8** or higher, could lead to privilege escalation or arbitrary code execution. The list includes:
- CVE‑2026‑48395 – **8.6** – Untrusted search path leading to arbitrary code execution
- CVE‑2026‑48396 – **8.6** – Incorrect authorization leading to arbitrary code execution
- CVE‑2026‑48390 – **8.6** – Incorrect authorization leading to privilege escalation
- CVE‑2026‑48391 – **8.2** – Untrusted search path leading to arbitrary code execution
- CVE‑2026‑48374 – **7.8** – Path traversal leading to arbitrary code execution
- CVE‑2026‑48392 – **7.8** – Out‑of‑bounds write leading to arbitrary code execution
- CVE‑2026‑48393 – **7.8** – Out‑of‑bounds write leading to arbitrary code execution
- CVE‑2026‑48394 – **7.8** – Out‑of‑bounds write leading to arbitrary code execution
Security researchers Kieran (“kaiksi”) and “yjdfy” were credited for discovering the Bridge bugs. Their work underscores how community‑driven reporting remains vital for large vendors like Adobe.
What This Means For You
If you’re a developer or an IT manager, the first step is to verify your ACC deployment version. Check the build number against the list above and apply the update immediately. Because the flaw doesn’t need user interaction, delaying patches could let an attacker gain silent access to your marketing data, potentially exposing customer PII or modifying campaign logic.
For teams that also use Adobe Bridge, inventory the installed version on every workstation and push the latest patches via your software distribution tool. The out‑of‑bounds write bugs, while less severe than the CVSS 10.0 issue, can still be used for privilege escalation, which could compromise internal assets beyond the design tools themselves.
Three concrete scenarios illustrate the urgency:
- Integrated CRM pipeline. Your marketing platform pushes leads into a CRM system via an API key stored on the Campaign Classic server. An unpatched instance lets a low‑privilege user inject a crafted request that runs a script on the server. The script then extracts the API key and writes it to a publicly accessible log file. An attacker harvests the key and gains full CRM access.
- On‑premise data lake. A financial services firm runs Campaign Classic on a Linux box that shares a network mount with a data lake. The “no‑click” exploit runs a binary that writes directly to the shared volume, planting a backdoor script. Later, a data‑processing job executes the backdoor, compromising downstream analytics.
- Creative workflow with Bridge. Designers on a remote office use Adobe Bridge to batch‑process images. An out‑of‑bounds write flaw lets a malicious actor craft a malformed image file that, when opened, spawns a shell with the same rights as the designer. The shell then reaches back to the corporate VPN, expanding the foothold.
In short, the window for safe operation is closing fast. Even though Adobe says there’s no evidence of active exploitation, the risk profile is high enough that any organization should treat these updates as critical, not optional.
Looking ahead, you’ll have to wonder how many other legacy marketing platforms might harbor similar “no‑click” vulnerabilities. As vendors continue to bundle more services, the attack surface expands, and the pressure to audit code paths grows.
Key Questions Remaining
While Adobe’s patches close the known gaps, several open‑ended issues remain for practitioners:
- Will future releases of Campaign Classic adopt a zero‑trust model for internal workflow calls, or will they continue to rely on role‑based checks?
- How quickly can organizations roll out the update across hybrid environments where some nodes run older operating system versions?
- What monitoring capabilities can be added to detect a “silent” exploitation attempt that leaves no obvious trace?
- Are there lessons from the Bridge disclosures that can be applied to other Adobe desktop products to prevent similar out‑of‑bounds writes?
Answering those questions will shape the next wave of hardening efforts. Until then, the safest bet is to patch now, verify the version, and tighten network controls around the affected services.
Sources: The Hacker News, Adobe Security Advisory
