Adobe has released a critical security update for Adobe Campaign Classic, addressing multiple vulnerabilities that could enable arbitrary code execution on affected systems. The update, identified as APSB26-120 and published on August 3, 2026, carries Adobe’s highest priority rating of 1.
Adobe Campaign Classic is a platform used by organizations to manage cross-channel marketing campaigns, customer profiles, email workflows, and campaign automation. A successful exploitation of these vulnerabilities could grant attackers access to sensitive marketing data, internal infrastructure, customer information, and connected systems.
Details of the Vulnerabilities
The most severe issues include three unauthenticated remote vulnerabilities, each assigned a CVSS score of 10.0, indicating maximum severity:
- CVE-2026-48331 – Server-Side Request Forgery (SSRF): This flaw allows attackers to make the vulnerable server send requests to internal services, cloud metadata endpoints, or systems that are typically inaccessible from the internet. Exploiting this vulnerability can enable attackers to access credentials, map internal networks, or reach administrative services.
- CVE-2026-48323 – Template Engine Injection: This vulnerability permits attackers to inject malicious code into the template engine, potentially leading to arbitrary code execution on the server.
- CVE-2026-48330 – SQL Injection: This flaw enables attackers to execute arbitrary SQL commands on the database, which can result in unauthorized data access or manipulation.
These vulnerabilities can be exploited remotely over a network without requiring authentication or user interaction, making internet-facing and externally accessible Campaign Classic deployments particularly vulnerable.
Additionally, Adobe addressed another SQL injection vulnerability, CVE-2026-48326, rated 9.9 out of 10. Unlike the maximum-severity SQL injection flaw, exploiting this issue requires low-level privileges. However, a malicious authenticated user or an attacker with stolen credentials could potentially use it to execute code and compromise the underlying server.
Another significant issue is CVE-2026-48333, rated 9.8, which is an incorrect authorization vulnerability that could allow privilege escalation. Attackers may exploit such flaws to access functions or data beyond their intended permissions.
The remaining issues include CVE-2026-48317, an eval injection vulnerability with a CVSS score of 9.6, and CVE-2026-48399, a security feature bypass flaw with a CVSS score of 7.5. Eval injection can occur when an application processes dynamic code unsafely, potentially allowing attackers to run attacker-controlled commands.
Mitigation and Recommendations
Adobe has released patches to address these vulnerabilities in Adobe Campaign Classic version 7.4.3 build 9399. Organizations using affected versions should upgrade to this latest build as soon as possible to mitigate potential risks.
It’s important to note that this security advisory applies to on-premise Adobe Campaign instances only, including fully on-premise deployments and on-premise components in hybrid deployments. No action is required for Adobe-hosted instances, as those environments have already been remediated.
Security teams should identify exposed Campaign Classic servers, apply build 9399, review administrative accounts, restrict unnecessary network access, and monitor logs for unusual requests, unexpected database activity, or suspicious changes to privileges.
While Adobe has stated that it is not aware of any exploits targeting these vulnerabilities in the wild, the critical severity, remote attack paths, and lack of authentication requirements make rapid remediation essential.
In the broader context, this incident underscores the importance of timely patch management and the need for organizations to stay vigilant about software vulnerabilities. As cyber threats continue to evolve, maintaining up-to-date systems and implementing robust security practices are crucial steps in safeguarding sensitive data and infrastructure.
