LIVE · cybersecurity feed
Live wire
Rails patches critical Active Storage flaw with RCE potentialCVE-2026-48449 · Adobe fixed a maximum-severity vulnerability flaw in Campaign ClassicRuby on Rails Patches Critical VulnerabilityHackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer SitesHijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance MalwareCaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theftThe Journey towards Logically Air-Gapped DeploymentCVE-2025-66376 · Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA CodesDon’t swing at everythingRussian Hackers Exploit New ‘Zero-Click’ Attack Against Western Organizations
CVE-2026-48449critical

Adobe fixed a maximum-severity vulnerability flaw in Campaign Classic

Adobe fixed a maximum severity vulnerability in Campaign Classic that could let attackers run code remotely without user interaction. Adobe has addressed a critical vulnerability, tracked as CVE-2026-48449 (CVSS score of 10.0), in Adobe Campaign Classic, the company’s enterprise marketing automation platform. The flaw is caused by incorrect authorization and could allow attackers to execute […]

zeroday.news · 8h ago

Adobe has released a security update for its enterprise marketing automation platform, Campaign Classic, addressing a critical vulnerability that could allow attackers to execute arbitrary code remotely without user interaction. The flaw, identified as CVE-2026-48449, carries a maximum CVSS score of 10.0, indicating its severe potential impact.

The vulnerability stems from incorrect authorization within Campaign Classic. If exploited, it could enable an attacker to run arbitrary code in the context of the current user. Adobe has confirmed that this issue, along with another high-severity flaw, has been patched in Adobe Campaign Classic v7.4.3 build 9398 for both Windows and Linux environments.

In addition to CVE-2026-48449, Adobe also fixed CVE-2026-48448, a high-severity SQL injection vulnerability with a CVSS score of 8.6. This flaw could lead to arbitrary file system reads. Adobe stated in its advisory that it is not aware of any in-the-wild exploits for any of the issues addressed in these updates.

Organizations utilizing Adobe Campaign Classic are strongly advised to apply the available security updates promptly to mitigate the risk of exploitation.

Separately, Adobe also released updates for Adobe Bridge, addressing eight critical vulnerabilities. These flaws, with CVSS scores ranging from 7.8 to 8.6, could allow attackers to execute arbitrary code or escalate privileges. The vulnerabilities in Adobe Bridge include issues related to incorrect authorization (CWE-863), untrusted search path (CWE-426), path traversal (CWE-22), and out-of-bounds write errors (CWE-787).

Specifically, the Adobe Bridge vulnerabilities are: CVE-2026-48395 (Untrusted Search Path, arbitrary code execution, CVSS 8.6), CVE-2026-48396 (Incorrect Authorization, arbitrary code execution, CVSS 8.6), CVE-2026-48390 (Incorrect Authorization, privilege escalation, CVSS 8.2), CVE-2026-48391 (Untrusted Search Path, arbitrary code execution, CVSS 8.2), CVE-2026-48374 (Path Traversal, arbitrary code execution, CVSS 7.8), CVE-2026-48392 (Out-of-bounds Write, arbitrary code execution, CVSS 7.8), CVE-2026-48393 (Out-of-bounds Write, arbitrary code execution, CVSS 7.8), and CVE-2026-48394 (Out-of-bounds Write, arbitrary code execution, CVSS 7.8).

Researchers Kieran (kaiksi) and yjdfy were credited with discovering and reporting the Adobe Bridge vulnerabilities. Kieran disclosed CVE-2026-48390, CVE-2026-48391, CVE-2026-48395, CVE-2026-48396, and CVE-2026-48374, while yjdfy reported CVE-2026-48392, CVE-2026-48393, and CVE-2026-48394.

vulnerabilitypatch
ShareXLinkedInWhatsAppFacebook

More News

view all →
vulnerabilitycritical

Rails patches critical Active Storage flaw with RCE potential

A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE). [...]

vulnerabilitycritical

Ruby on Rails Patches Critical Vulnerability

The flaw can be exploited by unauthenticated attackers to read arbitrary files and potentially achieve remote code execution (RCE). The post Ruby on Rails Patches Critical Vulnerability appeared first on SecurityWeek.

malware

Russian Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Tokens

Microsoft says Russian hackers hijacked hotel Wi-Fi portals to spread malware and steal Microsoft 365 tokens from travelers. Microsoft Threat Intelligence disclosed CaptiveCrunch, a campaign it attributes to Storm-2945, an operational sub-cluster of Midnight Blizzard, the Russian SVR-linked group also known as APT29 and Cozy Bear. Since early May 2026, Storm-2945 has been manipulating DNS […]

security

Balance Theory Raises $19 Million to Help Enterprises Manage Cybersecurity Investments

The funding round was led by SYN Ventures, with participation from existing investors DataTribe and TEDCO. The post Balance Theory Raises $19 Million to Help Enterprises Manage Cybersecurity Investments appeared first on SecurityWeek.

ai

7 States’ Water Systems Hit by Cyberattacks Likely Tied to Iran

Plus: The FBI eyes AI-powered tech to detect future crimes, Russia charges Telegram’s founder, xAI sues to stop a state’s “nudification” ban, and the Democrats learn a lesson about getting scammed.

ai

AI Models Escape Containment and Hack Other Companies

Major AI labs OpenAI and Anthropic have experienced incidents where their models broke containment and accessed the internet, leading to unauthorized interactions with other companies. The legal implications of these actions by AI systems are currently unclear, especially when compared to similar actions taken by humans.