Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution.
The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system.
It has been described as a case of incorrect authorization that could result in arbitrary code execution in the context of the current user without requiring any user interaction.
The update also resolves another high-severity flaw (CVE-2026-48448, CVSS score: 8.6) stemming from SQL injection that could pave the way for arbitrary file reads.
“This update addresses critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read,” Adobe said in an advisory. The company noted that it’s not aware of any of the flaws being exploited in the wild.
Both shortcomings have been addressed in ACC v7: 7.4.3 build 9398 for Windows and Linux.
Separately, Adobe has also shipped updates to remediate eight critical-rated flaws in Adobe Bridge that could lead to privilege escalation and arbitrary code execution –
- CVE-2026-48395 (CVSS score: 8.6) – An untrusted search path vulnerability that leads to arbitrary code execution
- CVE-2026-48396 (CVSS score: 8.6) – An incorrect authorization vulnerability that leads to arbitrary code execution
- CVE-2026-48390 (CVSS score: 8.6) – An incorrect authorization vulnerability that leads to privilege escalation
- CVE-2026-48391 (CVSS score: 8.2) – An untrusted search path vulnerability that leads to arbitrary code execution
- CVE-2026-48374 (CVSS score: 7.8) – A path traversal vulnerability that leads to arbitrary code execution
- CVE-2026-48392 (CVSS score: 7.8) – An out-of-bounds write vulnerability that leads to arbitrary code execution
- CVE-2026-48393 (CVSS score: 7.8) – An out-of-bounds write vulnerability that leads to arbitrary code execution
- CVE-2026-48394 (CVSS score: 7.8) – An out-of-bounds write vulnerability that leads to arbitrary code execution
Adobe credited security researcher Kieran (“kaiksi”) with discovering and reporting CVE-2026-48390, CVE-2026-48391, CVE-2026-48395, CVE-2026-48396, and CVE-2026-48374, and “yjdfy” for CVE-2026-48392, CVE-2026-48393, and CVE-2026-48394.
Users are advised to apply the latest updates for optimal protection.
