Threat reportVulnerabilityTL-2026-1790

Adobe Campaign Classic Critical Incorrect Authorization Flaw Enables Unauthenticated Remote Code Execution (CVE-2026-48449) Paired With SQL Injection Memory/File Disclosure (CVE-2026-48448)

criticalACTIVE

Adobe Campaign Classic Critical Incorrect Authorization Flaw (TL-2026-1790) is a critical-severity software vulnerability scored CVSS 10, first published 2026-07-31 and last reviewed 2026-08-09. It has no confirmed attribution, affects Adobe Campaign Classic (ACC) v7 — on-premise and hybrid deployments, references 10 CVEs (CVE-2026-48449, CVE-2026-48448, CVE-2026-48303), maps to 31 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 39 indicators of compromise.

CVSS
10/10Critical
CVEs
10Referenced vulnerabilities
Techniques
31MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
39Indicators of compromise

Key facts for TL-2026-1790

Threat ID
TL-2026-1790
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
marketingtechnology, retail, financialservices, mediaentertainment, telecoms, government administration
Target regions
Global
Detection rules
9
Indicators of compromise
39
Updates
2026-08-09 · 3 updates · revalidated 3× · latest source

Malware and tooling in Adobe Campaign Classic Critical Incorrect Authorization Flaw

Malware and tooling: None reported

How Adobe Campaign Classic Critical Incorrect Authorization Flaw works

Adobe Campaign Classic (ACC) v7 contains an Incorrect Authorization vulnerability (CVE-2026-48449, CVSS 10.0/CWE-863) enabling unauthenticated arbitrary code execution, and a related SQL Injection vulnerability (CVE-2026-48448, CVSS 8.6/CWE-89) that discloses sensitive memory and reads the file system. Both require no authentication or user interaction; Adobe patched them in build 9398 via APSB26-114, and on-premise/hybrid deployments are exposed since cloud instances are already remediated.

On July 30, 2026, Adobe published security bulletin APSB26-114 for Adobe Campaign Classic (ACC) v7, disclosing two vulnerabilities affecting build 9397 and earlier: CVE-2026-48449, a maximum-severity (CVSS 3.1 base score 10.0, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Incorrect Authorization flaw (CWE-863) that allows an unauthenticated, network-based attacker to achieve arbitrary code execution in the context of the current user without any interaction from a victim; and CVE-2026-48448, a high-severity (CVSS 3.1 base score 8.6, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) SQL Injection flaw (CWE-89) that lets the same class of unauthenticated attacker read arbitrary regions of application memory and access the underlying file system through injected SQL. Both flaws carry a Changed scope (S:C) in their CVSS vectors, indicating the vulnerable ACC component can affect resources beyond its own security scope once exploited. Adobe fixed both issues in ACC v7 7.4.3 build 9398; instances hosted by Adobe were already remediated and require no customer action, but fully on-premise deployments and the on-premise leg of hybrid deployments remain exposed until the customer applies the update.

The Dutch national CERT, NCSC-NL, republished the Adobe findings on July 31, 2026 as CSAF advisory NCSC-2026-0273 ("Kwetsbaarheden verholpen in Adobe Campaign Classic") to alert its constituency, citing APSB26-114 as the authoritative source and reiterating that exploitation of either CVE requires no privileges and no user interaction. Neither CVE-2026-48449 nor CVE-2026-48448 appears in the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing, and no public proof-of-concept exploit code, exploitation tooling, or in-the-wild attack activity has been reported for either vulnerability by Adobe, NCSC-NL, or open security reporting.

This is not an isolated event for ACC's authorization layer. One month earlier, Adobe shipped APSB26-69 (~June 30, 2026) fixing CVE-2026-48286, another maximum-severity (CVSS 10.0) Incorrect Authorization vulnerability in the same product affecting build 9396 and earlier, patched in build 9397 — the exact predecessor build range to the flaws documented here. The two disclosures one build-cycle apart establish a recurring pattern of authorization-layer weaknesses in ACC's on-premise component that defenders and Adobe itself should treat as a class-level risk, not a one-off bug. Adobe CSO Aanchal Gupta announced this cadence change on June 25, 2026 via the Adobe Security Blog, explicitly citing AI-accelerated vulnerability discovery — "frontier AI models and agentic analysis tooling now uncover flaws across large codebases far faster than traditional methods could" — as compressing the gap between disclosure and exploitation from days to hours; the new cadence (second and fourth Tuesday of each month) took effect July 14, 2026, meaning ACC administrators should expect a tighter, more frequent patch cycle going forward and should budget for Priority 1 (patch within ~72 hours) turnaround on future ACC bulletins. Notably, NVD's own CVE-2026-48449 and CVE-2026-48448 records show a published date of July 29, 2026 — one day ahead of the July 30 APSB26-114 bulletin text and public disclosure — with both records last-modified July 30, 2026 to align with the released bulletin; this is a coordinated-disclosure timing artifact, not evidence of independent pre-bulletin discovery.

Because CVE-2026-48449 grants code execution and CVE-2026-48448 grants memory/file-system read access on the same unauthenticated, network-reachable component, the two vulnerabilities are readily chainable: an attacker could use the SQL injection to enumerate configuration files, credentials, or session material before or after using the authorization bypass to execute arbitrary code, or use the authorization bypass alone to gain code execution directly. No evidence currently indicates this chaining has been observed in practice; the risk documented here is architectural/exploitability-based, consistent with the CVSS scoring and vendor advisory language, not a confirmed campaign.

MITRE ATT&CK techniques used in TL-2026-1790

Credential Access

T1003 OS Credential Dumping; T1212 Exploitation for Credential Access; T1552 Unsecured Credentials

Collection

T1005 Data from Local System; T1213 Data from Information Repositories; T1560 Archive Collected Data

Lateral Movement

T1021 Remote Services; T1210 Exploitation of Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1211 Exploitation for Defense Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053 Scheduled Task/Job; T1136 Create Account; T1505 Server Software Component

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1565 Data Manipulation

Resource Development

T1584 Compromise Infrastructure; T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Adobe Campaign Classic Critical Incorrect Authorization Flaw

  • Adobe — Campaign Classic (ACC) v7 — on-premise and hybrid deployments
    Vulnerable versions: 7.4.3 build 9397 and earlier (Windows and Linux)
    Fixed in: 7.4.3 build 9398

Remediation for Adobe Campaign Classic Critical Incorrect Authorization Flaw

Patches

  • Adobe Campaign Classic v7 7.4.3 build 9398 (APSB26-114) — fixes CVE-2026-48449 and CVE-2026-48448

Immediate actions

  • Apply Adobe Campaign Classic v7 7.4.3 build 9398 (APSB26-114) to every on-premise ACC instance and to the on-premise component of any hybrid deployment; Adobe-hosted instances are already patched and require no action
  • Until patched, place ACC servers behind a Web Application Firewall and restrict/monitor inbound requests to ACC management and API endpoints
  • Enforce network segmentation so ACC servers cannot reach unrelated internal systems, limiting blast radius if either flaw is exploited
  • Treat this as a Priority 1 patch and apply within 72 hours per Adobe's standard guidance for maximum-severity ACC/ColdFusion advisories

Workarounds

  • No official Adobe workaround is published for either CVE; WAF rules restricting ACC endpoints and network segmentation are compensating controls only, not substitutes for patching

Longer-term hardening

  • Restrict the ACC service account's OS-level privileges to reduce the impact of any future code-execution flaw in the product
  • Adopt Adobe's twice-monthly APSB bulletin cadence (effective mid-July 2026) into patch-management SLAs for ACC and related on-premise Adobe products
  • Given the recurrence of Incorrect Authorization (CWE-863) findings in ACC within a single build cycle (CVE-2026-48286 then CVE-2026-48449), prioritize an authorization-layer architecture review and request a hardening roadmap from Adobe
  • Audit and harden database-layer input handling for ACC's on-premise components to reduce exposure to future SQL injection class findings (CWE-89)

CVEs associated with Adobe Campaign Classic Critical Incorrect Authorization Flaw

CVE-2026-48449, CVE-2026-48448, CVE-2026-48303, CVE-2026-48331, CVE-2026-48323, CVE-2026-48330, CVE-2026-48326, CVE-2026-48333, CVE-2026-48317, CVE-2026-48286

Weaknesses (CWE) in Adobe Campaign Classic Critical Incorrect Authorization Flaw

CWE-863, CWE-89

Timeline of Adobe Campaign Classic Critical Incorrect Authorization Flaw

  • Adobe publishes security bulletin APSB26-66, patching CVE-2026-48303 — an unauthenticated Incorrect Authorization RCE flaw (CWE-863, CVSS 10.0) — in Campaign Classic build 7.4.3.9394 and earlier, fixed in build 9395. This predates the previously tracked predecessor (CVE-2026-48286, APSB26-69) and establishes a four-bulletin, eight-week recurring pattern rather than two.
  • Adobe CSO Aanchal Gupta publishes "Protecting customers faster: How Adobe is responding to AI-accelerated vulnerability discovery" on the Adobe Security Blog, announcing that Adobe will move from monthly to twice-monthly security bulletins (second and fourth Tuesday of each month) effective July 14, 2026, citing AI-accelerated vulnerability discovery compressing the window between disclosure and exploitation from days to hours.
  • Adobe ships APSB26-69, patching CVE-2026-48286 (NVD record published 2026-06-30T16:16:54Z) — an earlier maximum-severity (CVSS 10.0) Incorrect Authorization flaw in Adobe Campaign Classic v7 (build 9396 and earlier, fixed in build 9397), establishing the same CWE-863 vulnerability class one build cycle before this threat's CVEs.
  • Adobe's shift to a twice-monthly security bulletin cadence (announced June 25, 2026) takes effect, changing the disclosure rhythm under which subsequent Campaign Classic bulletins including APSB26-114 are issued.
  • NVD publishes the CVE-2026-48449 and CVE-2026-48448 records (assigner: Adobe Systems Incorporated), pre-dating the public Adobe bulletin by one day; both records carry CVSS 3.1 vectors matching the eventual APSB26-114 bulletin and reference it as the source advisory.
  • GitHub Advisory Database publishes GHSA-hq36-26qm-2p5q for CVE-2026-48449.
  • Canadian Centre for Cyber Security publishes advisory AV26-760 advising constituents to apply the APSB26-114 update.
  • CISA-ADP adds an SSVC assessment for both CVEs: exploitation status 'none', but both rated 'automatable', with technical impact 'total' for CVE-2026-48449 and 'partial' for CVE-2026-48448.
  • NVD last-modifies both CVE-2026-48449 and CVE-2026-48448 records the day after initial publication, aligning their public analysis with the just-released APSB26-114 bulletin text.
  • Adobe publishes security bulletin APSB26-114 for Adobe Campaign Classic v7, disclosing and patching CVE-2026-48449 (CVSS 10.0, Incorrect Authorization / unauthenticated RCE) and CVE-2026-48448 (CVSS 8.6, SQL Injection / memory and file-system disclosure), both affecting build 9397 and earlier and fixed in build 9398.
  • CISA Known Exploited Vulnerabilities catalog (dated 2026-07-29, 1,656 entries) checked; neither CVE-2026-48449, CVE-2026-48448, nor predecessor CVE-2026-48286 is present, consistent with Adobe's and NCSC-NL's statements that no in-the-wild exploitation is known as of publication.
  • TL-Intel Harness ingests the NCSC-2026-0273 advisory via the NCSC-NL Security Advisories RSS feed and opens hunt record TL-2026-1790.
  • Dutch national CERT NCSC-NL publishes CSAF advisory NCSC-2026-0273 ("Kwetsbaarheden verholpen in Adobe Campaign Classic") at 09:11:51 UTC (v1.0.0, Final), summarizing both CVEs for its constituency and reiterating no privileges or user interaction are required to exploit either flaw.
  • The Hacker News, CyberTech Edition, and DugganUSA publish further analysis naming a 'build 9397 trap': because CVE-2026-48449/CVE-2026-48448 follow the same-class CVE-2026-48286 one build cycle later, organizations that patched to build 9397 after APSB26-69 may believe they are protected but remain vulnerable until they update to build 9398.
  • Security Affairs, The Hacker News, and GBHackers publish independent coverage of CVE-2026-48449, amplifying visibility to defenders.
  • Adobe publishes APSB26-120 (Priority 1), patching six additional Campaign Classic flaws in build 9399 five days after APSB26-114: three more CVSS 10.0 unauthenticated RCE-class issues (SSRF CVE-2026-48331, server-side template injection CVE-2026-48323, SQL injection CVE-2026-48330), a low-privilege SQL injection (CVE-2026-48326, CVSS 9.9), a privilege-escalation Incorrect Authorization flaw (CVE-2026-48333, CVSS 9.8), a low-privilege eval-injection flaw (CVE-2026-48317, CVSS 9.6), and a security-feature-bypass issue (CVE-2026-48399, CVSS 7.5).
  • Adobe corrects the CVE-2026-48449/CVE-2026-48448 affected-status metadata, changing defaultStatus from 'unaffected' to 'affected' for ACC v7 deployments.
  • AusCERT publishes bulletin ESB-2026.9044 alerting its Australian constituency to the ACC vulnerabilities.

Update history for TL-2026-1790

Sources cited for Adobe Campaign Classic Critical Incorrect Authorization Flaw

Detection coverage for TL-2026-1790

As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1790 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
39 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats