CVE-2026-48449
Adobe Campaign Classic (ACC) has a critical authorization flaw that lets attackers run code as the user who is logged in. The bug can be triggered without any user action and can change the scope of the vulnerability. It is a severe flaw that could compromise the entire system.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Adobe Campaign Classic (ACC), the enterprise marketing automation platform used by organizations to manage campaigns.
Real-world impact
An attacker who exploits this flaw can execute arbitrary code with the privileges of the logged‑in user, potentially taking full control of the affected system.
Why this severity
The CVSS score of 10 reflects that the vulnerability is exploitable over the network, requires no user interaction, and allows attackers to gain complete control of the system with high confidentiality, integrity, and availability impact.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources