Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Adobe patches seven flaws in ColdFusion, Commerce, and Campaign Classic, including actively exploited CVE-2026-71362 enabling customer account takeover.
75
CVE-2026-48381
Unauthenticated SQL Injection Leading to RCE in Adobe Campaign Classic
- CVSS 3.1
- 9.0 critical
- EPSS
- <1%p46
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Adobe Campaign Classic contains an SQL injection flaw (CWE-89) that an attacker can leverage to execute arbitrary code in the context of the current user, with high confidentiality, integrity, and availability impact per Adobe's scoring. The flaw is reachable over the network without credentials (AV:N/PR:N) and requires no user interaction, but exploitation depends on conditions beyond the attacker's control (AC:H), and the changed scope (S:C) indicates the injected commands can affect resources beyond the vulnerable component. It affects organizations running Adobe Campaign Classic, Adobe's enterprise campaign-management platform, whose instances are typically deployed on-premises or in hybrid cloud setups. There is currently no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS estimates roughly a 0.6% probability of exploitation within 30 days. Adobe has published a fix in its security bulletin, and the disclosure arrives alongside Adobe's recent batch of critical ColdFusion and Campaign Classic patches.
What to do: Upgrade all Campaign Classic instances to the fixed build cited in Adobe's security bulletin for CVE-2026-48381, checking the advisory for updated version details since exact ranges are not yet in this data. Prioritize any instances with internet-facing components (web applications, APIs, mid-source servers) and restrict network access to the platform until patched. Given the absence of a public exploit but the critical CVSS 9.0 score and code-execution potential, treat this as a high-priority, near-term patch rather than an emergency.
| Product | Affected |
|---|---|
| Adobe Campaign Classic (ACC) | — |
Estimated exposure
moderateseveral thousand enterprise deployments (on the order of a few thousand organizations running ACC) — Adobe Campaign Classic is an enterprise marketing platform with a customer base on the order of a few thousand organizations, and its on-premises/hybrid deployment pattern means affected systems are likely in the low thousands rather than…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.