CVE-2026-48449

CVSS 3.1: 9.8 critical
EPSS: <1%p59
Published: Jul 30, 2026 · Jul 30, 2026
Modified: Oct 23, 2026

Analyze CVE-2026-48449 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Vendors: adobe

Products: campaign

Weakness: CWE-863

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news

3 stories

Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws

Adobe patches seven flaws in ColdFusion, Commerce, and Campaign Classic, including actively exploited CVE-2026-71362 enabling customer account takeover.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026VulnerabilityExploitedCVE-2026-48362 CVE-2026-48273 CVE-2026-71384+51 · 1 read

Adobe fixed a maximum-severity vulnerability flaw in Campaign Classic

Security AffairsAug 1, 12:31 UTC · Aug 1, 2026VulnerabilityCVE-2026-48449 CVE-2026-48448 CVE-2026-48395+71 · 1 read

Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction

The Hacker NewsAug 1, 07:12 UTC · Aug 1, 2026VulnerabilityExploitedCVE-2026-48449 CVE-2026-48448 CVE-2026-48395+73 · 1 read