type: incident · created: 2026-08-01 · updated: 2026-08-18 · tags: [] · confidence: not-rated · affected_sectors: [] · au_impact: false
Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
Summary
Adobe patched CVE-2026-48449 (CVSS 10.0), an incorrect authorization flaw in Campaign Classic (ACC) allowing arbitrary code execution without user interaction, alongside CVE-2026-48448 (CVSS 8.6, SQL injection → arbitrary file reads).
Key Details
- Date: 2026-08-01
- Source: The Hacker News
- Reliability: Tier 2/4 — Established cyber journalism
- CVE-2026-48449: CVSS 10.0 — Incorrect authorization → arbitrary code execution, no user interaction required
- CVE-2026-48448: CVSS 8.6 — SQL injection → arbitrary file reads
- Status: No known in-the-wild exploitation
- Fix Version: ACC v7: 7.4.3 build 9398
Related
- Cve 2026 48449 — Technical vulnerability page
- Cve 2026 48448 — Technical vulnerability page