CVE-2026-48286: Adobe Campaign RCE Vulnerability

CVE-2026-48286 Overview

CVE-2026-48286 is an Incorrect Authorization vulnerability [CWE-863] in Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier. The flaw allows attackers to execute arbitrary code in the context of the current user without any user interaction. The vulnerability is network-exploitable, requires no privileges, and results in a scope change, meaning it can affect components beyond the vulnerable one.

Adobe Campaign Classic is a cross-channel campaign management platform used by enterprises to orchestrate marketing communications. Successful exploitation grants attackers arbitrary code execution against affected servers.

Critical Impact
Unauthenticated attackers can achieve arbitrary code execution over the network with no user interaction, with full impact on confidentiality, integrity, and availability across security scopes.

Affected Products

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier
Deployments on Microsoft Windows
Deployments on Linux

Discovery Timeline

2026-06-30 - CVE-2026-48286 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-48286

Vulnerability Analysis

The vulnerability is classified as Incorrect Authorization [CWE-863]. Adobe Campaign Classic fails to properly enforce authorization checks on a network-accessible code path. Attackers can reach the vulnerable functionality without authentication and trigger arbitrary code execution in the context of the running user.

Because the CVSS scope is changed, exploitation impacts resources beyond the authorization boundary of the vulnerable component. This typically indicates that code executed against the Campaign Classic service can pivot to affect underlying operating system resources or adjacent services.

The EPSS score is 0.712% with a percentile of 49.079, indicating moderate near-term exploitation probability relative to other published CVEs.

Root Cause

The root cause is an authorization check that is either missing, incomplete, or evaluates permissions against an incorrect context. When a request reaches the vulnerable endpoint, Adobe Campaign Classic does not verify that the caller is entitled to invoke the operation. This allows unauthenticated network callers to reach privileged code paths that ultimately execute code on the host.

Attack Vector

The attack vector is network-based (AV:N). An attacker sends a crafted request to an exposed Adobe Campaign Classic instance. No authentication, privileges, or user interaction are required. The scope change indicates that successful exploitation affects components outside the security authority of the vulnerable service, enabling broader compromise of the host and connected assets.

No public proof-of-concept exploit code has been published as of the last modified date. Refer to the Adobe Security Advisory APSB26-69 for vendor-verified technical details.

Detection Methods for CVE-2026-48286

Indicators of Compromise

Unexpected child processes spawned by the Adobe Campaign Classic service account (nlserver and related processes) on Windows or Linux hosts.
Anomalous outbound network connections originating from Campaign Classic application servers to unknown external destinations.
Web server access logs containing unauthenticated requests to Campaign Classic endpoints followed by process execution on the host.
New or modified files in Campaign Classic installation directories or user profile paths without a corresponding change ticket.

Detection Strategies

Monitor process creation events where the Campaign Classic service is the parent of shells (cmd.exe, powershell.exe, /bin/sh, /bin/bash) or scripting interpreters.
Alert on Campaign Classic HTTP endpoints receiving requests from IP ranges outside the expected administrator or integration scope.
Correlate web request patterns with subsequent file writes or credential-access behavior on the same host within a short time window.

Monitoring Recommendations

Enable verbose logging on Adobe Campaign Classic application servers and forward logs to a centralized SIEM for retention and correlation.
Baseline normal Campaign Classic process trees and network destinations, then alert on deviations.
Restrict and monitor administrative access to Campaign Classic management interfaces, treating any unauthenticated invocation as high-severity.

How to Mitigate CVE-2026-48286

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-69 to all Adobe Campaign Classic instances at version 7.4.3 build 9396 or earlier.
Restrict network exposure of Adobe Campaign Classic servers so that only trusted management networks can reach administrative endpoints.
Audit Campaign Classic hosts for the indicators of compromise listed above before and after patching.
Rotate credentials, API keys, and service account passwords used by any Campaign Classic instance that was internet-exposed prior to patching.

Patch Information

Adobe has released a security update addressing CVE-2026-48286. Refer to Adobe Security Advisory APSB26-69 for the fixed build numbers and download locations. Administrators should upgrade beyond version 7.4.3 build 9396 to remediate the vulnerability.

Workarounds

Place Adobe Campaign Classic behind a reverse proxy or web application firewall configured to require authenticated sessions before requests reach the application.
Apply network-level access control lists to limit inbound traffic to Campaign Classic to known administrator and integration source addresses.
Disable or firewall off any Campaign Classic endpoint that is not required for business operations until the patch is applied.

bash

# Example: restrict inbound access to Adobe Campaign Classic on Linux using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP