CVE-2026-48381

Adobe Campaign Classic contains an SQL injection flaw (CWE-89) that an attacker can leverage to execute arbitrary code in the context of the current user, with high confidentiality, integrity, and availability impact per Adobe's scoring. The flaw is reachable over the network without credentials (AV:N/PR:N) and requires no user interaction, but exploitation depends on conditions beyond the attacker's control (AC:H), and the changed scope (S:C) indicates the injected commands can affect resources beyond the vulnerable component. It affects organizations running Adobe Campaign Classic, Adobe's enterprise campaign-management platform, whose instances are typically deployed on-premises or in hybrid cloud setups. There is currently no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS estimates roughly a 0.6% probability of exploitation within 30 days. Adobe has published a fix in its security bulletin, and the disclosure arrives alongside Adobe's recent batch of critical ColdFusion and Campaign Classic patches.

What to do: Upgrade all Campaign Classic instances to the fixed build cited in Adobe's security bulletin for CVE-2026-48381, checking the advisory for updated version details since exact ranges are not yet in this data. Prioritize any instances with internet-facing components (web applications, APIs, mid-source servers) and restrict network access to the platform until patched. Given the absence of a public exploit but the critical CVSS 9.0 score and code-execution potential, treat this as a high-priority, near-term patch rather than an emergency.