Key Takeaways
- Adobe patched a maximum‑severity flaw (CVE‑2026-48449, CVSS 10.0) in Campaign Classic that allows arbitrary code execution without user interaction.
- A second high‑severity SQL‑injection issue (CVE‑2026-48448, CVSS 8.6) in the same product could enable arbitrary file‑system reads.
- Both vulnerabilities have been resolved in Campaign Classic v7 build 9398 for Windows and Linux.
- Adobe also released fixes for eight critical‑rated flaws in Adobe Bridge, covering untrusted search paths, incorrect authorization, path traversal, and out‑of‑bounds write issues.
- Security researchers Kieran (“kaiksi”) and “yjdfy” were credited for discovering and reporting the Bridge vulnerabilities.
- Although no active exploitation has been observed, Adobe urges all users to apply the latest updates immediately to maintain optimal protection.
Overview of the Campaign Classic Critical Flaw
Adobe’s security advisory disclosed a maximum‑severity vulnerability identified as CVE‑2026-48449, scoring a perfect 10.0 on the CVSS scale. The flaw resides in the authorization logic of Campaign Classic, Adobe’s enterprise‑focused marketing automation platform. Because the authorization check can be bypassed, an attacker can execute arbitrary code in the context of the current user without requiring any interaction from the victim. This type of vulnerability is particularly dangerous in enterprise environments where Campaign Classic servers often handle sensitive customer data and marketing workflows.
Nature of the Incorrect Authorization Vulnerability
The incorrect authorization issue stems from insufficient validation of user‑supplied parameters when processing certain API requests. By crafting a specially formatted request, an unauthenticated or low‑privileged attacker can trick the application into granting elevated privileges, effectively allowing the execution of any code the attacker chooses. Since the exploit does not rely on user interaction, it can be triggered remotely via network‑accessible interfaces, increasing the attack surface for organizations that expose Campaign Classic services to internal or external networks.
Details of the Companion SQL Injection Flaw
In addition to the authorization bug, Adobe addressed a high‑severity SQL injection vulnerability tracked as CVE‑2026-48448, which carries a CVSS score of 8.6. This flaw arises from improper sanitization of input used in database queries within Campaign Classic. An attacker who can inject malicious SQL statements may read, modify, or delete data from the underlying database, and in certain configurations, leverage the injection to read arbitrary files on the server’s filesystem. While not as critical as the arbitrary code execution flaw, this issue still poses a significant risk to data confidentiality and integrity.
Advisory Statement and Exploitation Status
Adobe’s official advisory emphasized that the updates “address critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read.” The company explicitly noted that, as of the advisory date, there were no known instances of these flaws being exploited in the wild. Nevertheless, the presence of a CVSS 10.0 vulnerability warrants immediate attention, as attackers often develop exploits quickly once details become public.
Patched Versions and Deployment Guidance
The remediation is included in Campaign Classic version 7, specifically build 9398, which is available for both Windows and Linux platforms. Organizations running earlier releases should upgrade to this build as soon as possible. Adobe recommends verifying the update’s success by checking the version number in the administrative console and reviewing logs for any error messages during the installation process. For environments with high availability requirements, a staged rollout—first applying the patch to a test cluster, then to production—can help mitigate potential disruption.
Overview of Adobe Bridge Critical Updates
Separately, Adobe released a bundle of patches addressing eight critical‑rated vulnerabilities in Adobe Bridge, the digital asset management tool used by creative professionals. The flaws span several vulnerability classes, each capable of leading to privilege escalation or arbitrary code execution. The affected CVEs and their scores are:
- CVE‑2026-48395 (CVSS 8.6) – untrusted search path → arbitrary code execution
- CVE‑2026-48396 (CVSS 8.6) – incorrect authorization → arbitrary code execution
- CVE‑2026-48390 (CVSS 8.6) – incorrect authorization → privilege escalation
- CVE‑2026-48391 (CVSS 8.2) – untrusted search path → arbitrary code execution
- CVE‑2026-48374 (CVSS 7.8) – path traversal → arbitrary code execution
- CVE‑2026-48392 (CVSS 7.8) – out‑of‑bounds write → arbitrary code execution
- CVE‑2026-48393 (CVSS 7.8) – out‑of‑bounds write → arbitrary code execution
- CVE‑2026-48394 (CVSS 7.8) – out‑of‑bounds write → arbitrary code execution
Classification of Bridge Vulnerability Types
The untrusted search path flaws (CVE‑2026-48395 and CVE‑2026-48391) occur when Bridge loads DLLs or executables from directories an attacker can control, enabling the execution of malicious code when the application launches. The incorrect authorization issues (CVE‑2026-48396 and CVE‑2026-48390) similarly involve missing checks that allow low‑privileged users to perform actions reserved for administrators, ranging from executing arbitrary code to elevating privileges. The path traversal vulnerability (CVE‑2026-48374) lets attackers navigate outside intended directories to read or write files, which can be chained to achieve code execution. Finally, the three out‑of‑bounds write flaws (CVE‑2026-48392, CVE‑2026-48393, CVE‑2026-48394) stem from memory‑handling errors that, when exploited, can corrupt process memory and lead to arbitrary code execution.
Researcher Acknowledgments
Adobe credited security researcher Kieran, known online as “kaiksi,” for discovering and reporting CVE‑2026-48390, CVE‑2026-48391, CVE‑2026-48395, CVE‑2026-48396, and CVE‑2026-48374. The researcher “yjdfy” was acknowledged for identifying CVE‑2026-48392, CVE‑2026-48393, and CVE‑2026-48394. Responsible disclosure practices allowed Adobe to develop and release patches before the details became widely known, reducing the risk of zero‑day exploitation.
Recommendations for Users
Adobe urges all administrators and end‑users of Campaign Classic and Adobe Bridge to apply the latest updates immediately. For Campaign Classic, this means upgrading to v7 build 9398; for Bridge, installing the cumulative security patch that addresses the eight CVEs listed above. Organizations should also review their network exposure, ensuring that management interfaces are not unnecessarily accessible from untrusted networks, and consider implementing additional controls such as application whitelisting and least‑privilege principles to limit the potential impact of any future vulnerabilities. By staying current with vendor patches and maintaining a robust security posture, enterprises can mitigate the risks posed by these high‑severity flaws.