Critical Adobe Campaign Flaws Let Unauthenticated Attackers Execute Arbitrary Code

Adobe has released an urgent security update for Adobe Campaign Classic, addressing multiple critical vulnerabilities that could allow remote attackers to execute arbitrary code on vulnerable servers without authentication.

The update is documented in bulletin APSB26-120, published on August 3, 2026, and carries Adobe’s highest Priority 111 rating. The company urges organizations that use affected on-premises installations of Adobe Campaign Classic to upgrade immediately.

The update applies to Adobe Campaign Classic version 7.4.3 build 9398 and earlier on both Windows and Linux platforms. Customers must upgrade to version 7.4.3 build 9399.

Adobe-hosted instances have already been patched; however, the advisory pertains to fully on-premises deployments and on-premises components of hybrid environments.

Critical Adobe Campaign Flaws

The most severe vulnerabilities identified are CVE-2026-48331, CVE-2026-48323, and CVE-2026-48330, each assigned a maximum CVSS score of 10.0.

All three vulnerabilities are remotely exploitable over the network, require no privileges or user interaction, and can enable arbitrary code execution.

CVE-2026-48331 is a server-side request forgery (SSRF) vulnerability, categorized as CWE-918. SSRF flaws can allow attackers to manipulate a server into making requests to internal services, cloud metadata endpoints, or other restricted network resources. Successful exploitation of this vulnerability may lead to arbitrary code execution.

CVE-2026-48323 is caused by improper neutralization of special elements in a template engine, also known as template injection. This flaw allows attackers to inject or manipulate server-side template expressions, enabling them to execute malicious commands within the application’s processing environment.

CVE-2026-48330 is a SQL injection vulnerability that does not require authentication and has a CVSS score of 10.0. Another SQL injection vulnerability, CVE-2026-48326, requires low privileges and is rated 9.9.

Adobe has also patched CVE-2026-48333, an incorrect authorization flaw with a CVSS score of 9.8, which can lead to privilege escalation. CVE-2026-48317, an eval injection vulnerability rated 9.6, could allow a low-privileged attacker to execute arbitrary code.

Furthermore, CVE-2026-48399 is a security feature bypass vulnerability resulting from a violation of secure design principles, with a CVSS score of 7.5 and the potential to expose sensitive information.

Although Adobe has stated that it is not aware of any active exploitation of these vulnerabilities, the combination of unauthenticated network access, maximum severity ratings, and the potential for arbitrary code execution makes them highly attractive targets for threat actors.

Organizations should promptly upgrade Adobe Campaign Classic to version 7.4.3 build 9399. Security teams are also advised to restrict public access to administrative and application interfaces, review web and application logs for anomalous requests, and investigate unexpected outbound connections from Campaign servers.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.