Adobe has released security updates to address critical vulnerabilities in its Campaign Classic (ACC) and Bridge applications, aiming to prevent potential arbitrary code execution and privilege escalation attacks.
Critical Vulnerabilities in Adobe Campaign Classic
In Campaign Classic, a marketing automation platform used by enterprises, Adobe identified two significant security flaws:
- CVE-2026-48449: This vulnerability, rated with a maximum severity score of 10.0 on the Common Vulnerability Scoring System (CVSS), is due to incorrect authorization mechanisms. It allows attackers to execute arbitrary code without requiring user interaction.
- CVE-2026-48448: With a CVSS score of 8.6, this high-severity flaw stems from SQL injection issues, potentially enabling attackers to read arbitrary files on the system.
Adobe has addressed these vulnerabilities in ACC version 7.4.3 build 9398 for both Windows and Linux platforms. The company has stated that, to date, there is no evidence of these flaws being exploited in the wild.
Security Updates for Adobe Bridge
Adobe Bridge, a digital asset management application, also received updates to mitigate eight critical vulnerabilities that could lead to privilege escalation and arbitrary code execution. Notable among these are:
- CVE-2026-48395: An untrusted search path vulnerability leading to arbitrary code execution.
- CVE-2026-48396: An incorrect authorization vulnerability resulting in arbitrary code execution.
- CVE-2026-48390: An incorrect authorization vulnerability that could lead to privilege escalation.
These vulnerabilities have been addressed in the latest updates for Adobe Bridge. Adobe credited security researchers Kieran (“kaiksi”) and “yjdfy” for reporting these issues.
Given the critical nature of these vulnerabilities, it is imperative for organizations using Adobe Campaign Classic and Adobe Bridge to apply the latest security updates promptly. Delaying these updates could expose systems to potential attacks, leading to unauthorized code execution and data breaches. Regularly updating software and monitoring for security advisories are essential practices in maintaining a secure IT environment.
