CVE-2026-48449 is a critical incorrect authorization flaw (CVSS 10.0) in Adobe Campaign Classic that could result in arbitrary code execution as the current user. No user interaction is required and the scope is changed. Adobe's bulletin APSB26-114 lists the fixed build, so apply it now.
What's affected
Adobe Campaign Classic (ACC), which the record shows running on Linux and Windows. The record gives no version numbers and the Adobe bulletin page did not load for our review, so read APSB26-114 for the affected builds and the fixed build.
The vector is network based with no privileges, low complexity and no user interaction, which is why the score is the maximum 10.0.
How to check if you're exposed
Find every Campaign Classic server, including marketing automation hosts and any web tier. Read the build number from the console or from the server's version information, and compare it with the fixed build in APSB26-114.
Also check which of these servers are reachable from the internet, since the vector needs no privileges.
What to do now
- Read APSB26-114 and note the fixed build for your release.
- Schedule the update for every Campaign Classic server, starting with those exposed to the internet.
- Review who and what can reach Campaign endpoints, and restrict access where you can.
- Check the service account rights on the server, so a compromise reaches as little as possible.
Why it matters
The class is CWE-863, incorrect authorization. The system lets a caller do something its checks should have refused. Here the outcome, according to the advisory, is code execution as the current user, and the changed scope means the effects can spread past the vulnerable component.
A score of 10.0 means every vector factor is at its worst: remote, easy, no login, no click. Treat the update as a priority even without reports of attacks. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-48449 is a handy place to follow later updates.
Quick check
Does a 10.0 score mean it is being exploited?
No. The score rates severity, not activity. This record is not marked as exploited, but the severity alone justifies a quick update.
Sources
Last reviewed: 19 October 2026.
