# Adobe Campaign Classic Critical Incorrect Authorization Flaw Enables Unauthenticated Remote Code Execution (CVE-2026-48449) Paired With SQL Injection Memory/File Disclosure (CVE-2026-48448)

> Adobe Campaign Classic (ACC) v7 contains an Incorrect Authorization vulnerability (CVE-2026-48449, CVSS 10.0/CWE-863) enabling unauthenticated arbitrary code execution, and a related SQL Injection vulnerability (CVE-2026-48448, CVSS 8.6/CWE-89) that discloses sensitive memory and reads the file system. Both require no authentication or user interaction; Adobe patched them in build 9398 via APSB26-114, and on-premise/hybrid deployments are exposed since cloud instances are already remediated.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-08-09T02:04:37.349Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1790
- **ID:** TL-2026-1790
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-48449, CVE-2026-48448, CVE-2026-48303, CVE-2026-48331, CVE-2026-48323, CVE-2026-48330, CVE-2026-48326, CVE-2026-48333, CVE-2026-48317, CVE-2026-48286

## Description

On July 30, 2026, Adobe published security bulletin APSB26-114 for Adobe Campaign Classic (ACC) v7, disclosing two vulnerabilities affecting build 9397 and earlier: CVE-2026-48449, a maximum-severity (CVSS 3.1 base score 10.0, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Incorrect Authorization flaw (CWE-863) that allows an unauthenticated, network-based attacker to achieve arbitrary code execution in the context of the current user without any interaction from a victim; and CVE-2026-48448, a high-severity (CVSS 3.1 base score 8.6, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) SQL Injection flaw (CWE-89) that lets the same class of unauthenticated attacker read arbitrary regions of application memory and access the underlying file system through injected SQL. Both flaws carry a Changed scope (S:C) in their CVSS vectors, indicating the vulnerable ACC component can affect resources beyond its own security scope once exploited. Adobe fixed both issues in ACC v7 7.4.3 build 9398; instances hosted by Adobe were already remediated and require no customer action, but fully on-premise deployments and the on-premise leg of hybrid deployments remain exposed until the customer applies the update.

The Dutch national CERT, NCSC-NL, republished the Adobe findings on July 31, 2026 as CSAF advisory NCSC-2026-0273 ("Kwetsbaarheden verholpen in Adobe Campaign Classic") to alert its constituency, citing APSB26-114 as the authoritative source and reiterating that exploitation of either CVE requires no privileges and no user interaction. Neither CVE-2026-48449 nor CVE-2026-48448 appears in the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing, and no public proof-of-concept exploit code, exploitation tooling, or in-the-wild attack activity has been reported for either vulnerability by Adobe, NCSC-NL, or open security reporting.

This is not an isolated event for ACC's authorization layer. One month earlier, Adobe shipped APSB26-69 (~June 30, 2026) fixing CVE-2026-48286, another maximum-severity (CVSS 10.0) Incorrect Authorization vulnerability in the same product affecting build 9396 and earlier, patched in build 9397 — the exact predecessor build range to the flaws documented here. The two disclosures one build-cycle apart establish a recurring pattern of authorization-layer weaknesses in ACC's on-premise component that defenders and Adobe itself should treat as a class-level risk, not a one-off bug. Adobe CSO Aanchal Gupta announced this cadence change on June 25, 2026 via the Adobe Security Blog, explicitly citing AI-accelerated vulnerability discovery — "frontier AI models and agentic analysis tooling now uncover flaws across large codebases far faster than traditional methods could" — as compressing the gap between disclosure and exploitation from days to hours; the new cadence (second and fourth Tuesday of each month) took effect July 14, 2026, meaning ACC administrators should expect a tighter, more frequent patch cycle going forward and should budget for Priority 1 (patch within ~72 hours) turnaround on future ACC bulletins. Notably, NVD's own CVE-2026-48449 and CVE-2026-48448 records show a published date of July 29, 2026 — one day ahead of the July 30 APSB26-114 bulletin text and public disclosure — with both records last-modified July 30, 2026 to align with the released bulletin; this is a coordinated-disclosure timing artifact, not evidence of independent pre-bulletin discovery.

Because CVE-2026-48449 grants code execution and CVE-2026-48448 grants memory/file-system read access on the same unauthenticated, network-reachable component, the two vulnerabilities are readily chainable: an attacker could use the SQL injection to enumerate configuration files, credentials, or session material before or after using the authorization bypass to execute arbitrary code, or use the authorization bypass alone to gain code execution directly. No evidence currently indicates this chaining has been observed in practice; the risk documented here is architectural/exploitability-based, consistent with the CVSS scoring and vendor advisory language, not a confirmed campaign.

## MITRE ATT&CK

- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1136 Create Account
- T1068 Exploitation for Privilege Escalation
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials
- T1212 Exploitation for Credential Access
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation
- T1592 Gather Victim Host Information
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1203 Exploitation for Client Execution
- T1003 OS Credential Dumping
- T1021 Remote Services
- T1560 Archive Collected Data
- T1105 Ingress Tool Transfer
- T1053 Scheduled Task/Job
- T1584 Compromise Infrastructure
- T1211 Exploitation for Defense Evasion

## Sources

- [NCSC-2026-0273: Kwetsbaarheden verholpen in Adobe Campaign Classic](https://advisories.ncsc.nl/csaf/v2/2026/ncsc-2026-0273.json)
- [Adobe Security Bulletin APSB26-114 — Security Updates Available for Adobe Campaign Classic](https://helpx.adobe.com/security/products/campaign/apsb26-114.html)
- [NVD — CVE-2026-48449 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-48449)
- [NVD — CVE-2026-48448 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-48448)
- [Adobe Campaign Classic: Critical RCE via Incorrect Authorization (CVE-2026-48449)](https://www.thehackerwire.com/adobe-campaign-classic-critical-rce-via-incorrect-authorization-cve-2026-48449/)
- [CVE-2026-48448: Adobe Campaign Classic (ACC) is Affected by an Improper Neutralization / SQL Injection Flaw](https://www.thehackerwire.com/cve-2026-48448-adobe-campaign-classic-acc-is-affected-by-an-improper-n/)
- [Adobe ColdFusion and Campaign Classic: Critical RCE Flaws Among Multiple CVSS 10.0 Issues](https://socradar.io/blog/adobe-coldfusion-campaign-classic-rce-flaws/)
- [Adobe Patches Seven Max Severity ColdFusion, Campaign Flaws (predecessor bulletin coverage, CVE-2026-48286)](https://www.bleepingcomputer.com/news/security/adobe-patches-seven-max-severity-coldfusion-campaign-flaws/)
- [Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic (predecessor bulletin coverage, CVE-2026-48286)](https://thehackernews.com/2026/07/adobe-patches-7-cvss-100-flaws-in.html)
- [Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities (predecessor bulletin coverage, CVE-2026-48286)](https://www.securityweek.com/adobe-patches-critical-coldfusion-campaign-classic-vulnerabilities/)
- [Adobe Fixed Multiple Maximum-Severity Flaws in ColdFusion and Campaign Classic (predecessor bulletin coverage, CVE-2026-48286)](https://securityaffairs.com/194622/security/adobe-fixed-multiple-maximum-severity-flaws-in-coldfusion-and-campaign-classic.html)
- [CVE-2026-48286: Adobe Campaign Classic Incorrect Authorization Flaw — What It Means for Your Business and How to Respond](https://integsec.com/blog/cve-2026-48286-adobe-campaign-classic-incorrect-authorization-flaw-what-it-means-for-your-business-and-how-to-respond?hs_amp=true)
- [CVE-2026-48286: Adobe Campaign Classic (ACC) Remote Code Execution](https://www.sherlockforensics.com/blog/2026-06-30-cve-2026-48286.html)
- [Protecting customers faster: How Adobe is responding to AI-accelerated vulnerability discovery](https://blog.adobe.com/security/protecting-customers-faster-how-adobe-is-responding-to-ai-accelerated-vulnerability-discovery)
- [Adobe premieres a second Patch Tuesday each month to deliver fixes faster](https://www.csoonline.com/article/4192789/adobe-premieres-a-second-patch-tuesday-each-month-to-deliver-fixes-faster.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1790