A CVSS 10.0 in Adobe Campaign Classic Needs Nobody to Open Anything. It Has Been Patched Four Days and Almost Nobody Has Written About It.
- Patrick Duggan
- 12 hours ago
- 5 min read
Adobe shipped APSB26-114 on 29 July. Two vulnerabilities in Adobe Campaign Classic v7, both fixed in build 9397 → 9398, on Windows and Linux.
The headline one is [CVE-2026-48449](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-48449). Incorrect authorization leading to arbitrary code execution. CVSS 10.0. No authentication. No user interaction. Adobe rated the patch Priority 1 — their highest urgency tier.
Its companion, [CVE-2026-48448](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-48448), is a SQL injection giving arbitrary file-system reads. CVSS 8.6. On its own that would be the story.
Adobe says it is not aware of exploitation in the wild. It is not in CISA's KEV catalog. There is no public proof-of-concept we can find. That is the entire reason to write this now rather than in three weeks.
Why we are covering a patch nobody is exploiting
Because that is the only useful moment.
We spent this week writing about the opposite situation — an out-of-bounds write in Schneider IGSS and four in Rockwell Arena, all of which carry UI:R, user interaction required. Somebody has to open a malicious file. Our argument there was that the attacker's remaining problem is a targeting problem: find the engineer, learn what format they open without thinking.
CVE-2026-48449 has no such problem. There is no engineer to find. There is no file to get opened. There is a network-reachable server and an authorization check that does not hold.
What this box actually is
Adobe Campaign Classic is enterprise marketing automation. That description undersells the blast radius considerably, so let us be specific about what lives on one.
It holds the marketing database — names, email addresses, postal addresses, purchase and behavioural history, segmentation attributes. In a lot of deployments that is the most complete customer record the company owns, more complete than the CRM, because it accumulates engagement telemetry the CRM never sees.
It holds stored SMTP credentials, because its job is to send mail.
And it holds the practical ability to send mail as the brand — through the brand's own sending domain, with the brand's own SPF alignment and DKIM signature, to the brand's own verified recipient list.
Arbitrary code execution on that server is not only a data breach. It is a fully warmed, fully authenticated, fully deliverable phishing platform, handed over with the recipient list included and the reputation already built. Nothing in the receiving mail infrastructure will flag it, because nothing about it is forged.
We have been running a brand-impersonation beat for months, largely alongside Matt Lucas and the team at RedEye Security, whose passive-DNS and certificate-transparency work is where a lot of that hunting starts. Almost everything in that beat is attackers building a convincing imitation of a brand's infrastructure — lookalike domains, cloned templates, freshly-issued certificates. This is the other thing. This is not imitating the sender. This is becoming the sender.
Who is actually exposed
This is the part that decides whether the CVSS 10.0 matters to you.
Campaign Classic ships in two shapes. Managed Cloud Services customers are patched by Adobe on Adobe's schedule; if that is you, this is largely somebody else's evening. On-premise and hybrid v7 customers patch themselves.
So the exposed population is self-hosted Campaign Classic. In our experience that skews two ways at once, and both are bad here:
Regulated industries who kept the marketing database in their own estate precisely because it holds customer PII — healthcare systems, insurers, credit unions, regional banks. They self-hosted for data-residency and audit reasons, which is a defensible decision that also means the patch is theirs to apply.
Organisations that could not afford the cloud migration. Campaign Classic v7 is a mature product with a long on-prem tail. The shops still running it in 2026 are frequently the ones without the budget or the integration headroom to move, and frequently the ones without a person whose job is watching Adobe's PSIRT feed on a Wednesday in July.
That second group is who we write for. A CVSS 10.0 with no user interaction, in a product whose remaining self-hosted install base is disproportionately under-resourced, four days old and not yet weaponised — that is exactly the window where a short post is worth more than a long incident report.
What to do, in the order that matters
Establish your build number first. The vulnerable line is v7.4.3 build 9397 and earlier. The fix is build 9398. Everything else in this section depends on knowing which side of that line you are on.
Then get the server off the open internet. Campaign Classic's application and console tiers do not need to be publicly reachable for most deployments. If yours is, that is a bigger finding than the CVE and it will outlive this patch cycle. Put it behind the VPN.
Then patch to 9398. Priority 1 exists for a reason.
Then rotate the SMTP credentials, regardless of whether you believe you were touched. If the RCE was reachable, so were the credentials, and rotation is cheap compared with the alternative.
Then read your outbound send logs for the period you were exposed. You are not looking for a big obvious blast. You are looking for a small campaign to a segment nobody in marketing remembers building.
That last one is the check most organisations will skip, and it is the one that would actually catch this being used the way we would expect it to be used.
What we are not claiming
We have no indicator for this. Nothing in our feed is attributable to CVE-2026-48449, because as far as anyone has reported there is nothing yet to attribute. We did not discover it, we are not ahead of anybody on it, and we have no proof-of-concept.
What we have is a read on the shape and on who is holding the risk. Adobe published the fix on 29 July. Coverage since has been thin — a handful of outlets ran the CVSS number and moved on. Four days into a Priority 1 with no authentication requirement, on a class of server that holds the customer list and the sending keys, that thinness is itself worth pointing at.
If it turns up in KEV in a month, this post is the receipt for having said so while the window was still open. If it never does, that is the better outcome and the advice above cost you an afternoon.
Sources: Adobe Security Bulletin APSB26-114 · The Hacker News · Security Affairs
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.