Adobe Patches Maximum-Severity CVSS 10.0 Flaw in Campaign Classic

Adobe has released security updates that close a maximum-severity vulnerability in Campaign Classic (ACC), its enterprise marketing automation platform. The issue, assigned the identifier CVE-2026-48449, has been rated 10.0 on the CVSS scale.

Code execution with a single click not needed

The vulnerability is described as a case of improper authorization leading to arbitrary code execution in the context of the current user. The key detail that earned the flaw its top score is that the attack requires no interaction whatsoever on the victim's part.

Alongside it, another serious defect has been fixed — CVE-2026-48448 (CVSS 8.6). This is a SQL injection that opens up the possibility of reading arbitrary files. Both issues are patched in ACC v7: 7.4.3, build 9398, for Windows and Linux. According to Adobe, there are as yet no signs of these vulnerabilities being exploited in real-world attacks.

Eight critical holes in Adobe Bridge

In a separate update package, Adobe closed eight critical vulnerabilities in the graphics manager Adobe Bridge. They lead to privilege escalation and arbitrary code execution, with scores ranging from 7.8 to 8.6. Among the causes are the use of an untrusted search path, improper authorization, directory traversal (path traversal), and an out-of-bounds write.

Five of these findings — CVE-2026-48390, 48391, 48395, 48396, and 48374 — Adobe credited to a researcher named Kiran, using the handle “kaiksi.” Three more vulnerabilities, related to out-of-bounds writes (CVE-2026-48392, 48393, and 48394), were discovered by a specialist going by the alias “yjdfy.”

Users of all the listed products are advised to install the latest updates as soon as possible for optimal protection.

Source: The Hacker News