CVE-2026-48303: Adobe Campaign Classic RCE Vulnerability

CVE-2026-48303 Overview

CVE-2026-48303 is an Incorrect Authorization vulnerability [CWE-863] affecting Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier. The flaw allows unauthenticated network attackers to execute arbitrary code in the context of the current user. Exploitation requires no user interaction, and the scope is changed, meaning the impact extends beyond the vulnerable component. Adobe disclosed the issue in security advisory APSB26-66.

Critical Impact
Unauthenticated attackers can achieve arbitrary code execution across the affected Adobe Campaign Classic deployment with no user interaction required.

Affected Products

Adobe Campaign Classic (ACC) version 7.4.3 build 9394
Adobe Campaign Classic (ACC) versions earlier than 7.4.3 build 9394
Adobe Campaign Classic v7 deployments running affected builds

Discovery Timeline

2026-06-09 - CVE-2026-48303 published to the National Vulnerability Database (NVD)
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-48303

Vulnerability Analysis

CVE-2026-48303 is an Incorrect Authorization weakness [CWE-863] in Adobe Campaign Classic. The application performs an authorization check but fails to enforce it correctly, allowing actions that should be restricted. Because the scope is changed, a successful exploit affects resources beyond the vulnerable component's security boundary.

The Exploit Prediction Scoring System (EPSS) currently rates exploitation probability at 0.498% (66th percentile). Adobe has not reported in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Adobe Campaign typically handles large-scale customer marketing data, which raises the operational impact of arbitrary code execution within the application context.

Root Cause

The root cause is improper enforcement of authorization controls on a privileged operation exposed by Adobe Campaign Classic. The application validates a request path that should require elevated privileges, but the authorization decision is incomplete or bypassable. An attacker who reaches the exposed network interface can trigger functionality reserved for trusted users.

Attack Vector

The attack vector is Network. The attacker sends crafted requests to the Adobe Campaign Classic service without prior authentication or user interaction. Successful exploitation results in arbitrary code execution in the context of the current user account running the application. No verified proof-of-concept code is publicly available at this time. Refer to the Adobe Security Advisory APSB26-66 for vendor technical details.

Detection Methods for CVE-2026-48303

Indicators of Compromise

Unexpected child processes spawned by the Adobe Campaign Classic application service account
Anomalous outbound network connections originating from ACC server hosts
New or modified files in Adobe Campaign installation directories outside of patch windows
Authentication or authorization audit log entries showing privileged operations without a corresponding authenticated session

Detection Strategies

Monitor ACC application logs for requests that invoke privileged operations without a valid session token
Correlate web access logs with process creation events on the underlying host to identify request-to-execution chains
Alert on Adobe Campaign Classic versions at or below 7.4.3 build 9394 detected during asset inventory scans

Monitoring Recommendations

Enable verbose authentication and authorization logging on all ACC frontend and backend nodes
Forward ACC application, web server, and host telemetry to a centralized analytics platform for correlation
Baseline normal command-line activity for the ACC service account and alert on deviations
Track network flows between ACC servers and internal systems to detect lateral movement following exploitation

How to Mitigate CVE-2026-48303

Immediate Actions Required

Inventory all Adobe Campaign Classic installations and identify instances running 7.4.3 build 9394 or earlier
Apply the security update referenced in Adobe Security Advisory APSB26-66 as soon as possible
Restrict network exposure of ACC management and API endpoints to trusted administrative networks only
Rotate credentials and review audit logs for any signs of prior unauthorized access

Patch Information

Adobe has released a fix as documented in Adobe Security Advisory APSB26-66. Administrators should upgrade Adobe Campaign Classic to the build identified in the advisory that supersedes 7.4.3 build 9394. Validate the upgrade in a staging environment before production rollout and confirm the patched build number after deployment.

Workarounds

Place ACC servers behind a web application firewall and block requests targeting the affected endpoints until patching is complete
Limit ACC service account privileges on the underlying operating system to reduce the blast radius of arbitrary code execution
Enforce network segmentation so ACC servers cannot reach unrelated internal systems

bash

# Configuration example: restrict ACC management interface to an administrative subnet
# Replace 10.0.10.0/24 with your administrative network range
iptables -A INPUT -p tcp --dport 8080 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP