Adobe has released a security update for its enterprise marketing automation platform, Campaign Classic, addressing a critical vulnerability that could allow attackers to execute arbitrary code remotely without user interaction. The flaw, identified as CVE-2026-48449, carries a maximum CVSS score of 10.0, indicating its severe potential impact.
The vulnerability stems from incorrect authorization within Campaign Classic. If exploited, it could enable an attacker to run arbitrary code in the context of the current user. Adobe has confirmed that this issue, along with another high-severity flaw, has been patched in Adobe Campaign Classic v7.4.3 build 9398 for both Windows and Linux environments.
In addition to CVE-2026-48449, Adobe also fixed CVE-2026-48448, a high-severity SQL injection vulnerability with a CVSS score of 8.6. This flaw could lead to arbitrary file system reads. Adobe stated in its advisory that it is not aware of any in-the-wild exploits for any of the issues addressed in these updates.
Organizations utilizing Adobe Campaign Classic are strongly advised to apply the available security updates promptly to mitigate the risk of exploitation.
Separately, Adobe also released updates for Adobe Bridge, addressing eight critical vulnerabilities. These flaws, with CVSS scores ranging from 7.8 to 8.6, could allow attackers to execute arbitrary code or escalate privileges. The vulnerabilities in Adobe Bridge include issues related to incorrect authorization (CWE-863), untrusted search path (CWE-426), path traversal (CWE-22), and out-of-bounds write errors (CWE-787).
Specifically, the Adobe Bridge vulnerabilities are: CVE-2026-48395 (Untrusted Search Path, arbitrary code execution, CVSS 8.6), CVE-2026-48396 (Incorrect Authorization, arbitrary code execution, CVSS 8.6), CVE-2026-48390 (Incorrect Authorization, privilege escalation, CVSS 8.2), CVE-2026-48391 (Untrusted Search Path, arbitrary code execution, CVSS 8.2), CVE-2026-48374 (Path Traversal, arbitrary code execution, CVSS 7.8), CVE-2026-48392 (Out-of-bounds Write, arbitrary code execution, CVSS 7.8), CVE-2026-48393 (Out-of-bounds Write, arbitrary code execution, CVSS 7.8), and CVE-2026-48394 (Out-of-bounds Write, arbitrary code execution, CVSS 7.8).
Researchers Kieran (kaiksi) and yjdfy were credited with discovering and reporting the Adobe Bridge vulnerabilities. Kieran disclosed CVE-2026-48390, CVE-2026-48391, CVE-2026-48395, CVE-2026-48396, and CVE-2026-48374, while yjdfy reported CVE-2026-48392, CVE-2026-48393, and CVE-2026-48394.
