CVE-2026-48317: Adobe Campaign Classic RCE Vulnerability

CVE-2026-48317 Overview

CVE-2026-48317 is an Eval Injection vulnerability in Adobe Campaign Classic (ACC). The flaw stems from improper neutralization of directives passed to a dynamic code evaluation routine [CWE-95]. A low-privileged, authenticated attacker can send crafted input over the network to execute arbitrary code in the context of the current user. Exploitation does not require user interaction, and the vulnerability results in a scope change, allowing impact beyond the vulnerable component. Adobe addressed the issue in security bulletin APSB26-120. Affected builds include Adobe Campaign Classic 7.4.3 releases 9394, 9396, 9397, and 9398 across supported Linux and Windows deployments.

Critical Impact
Authenticated attackers can achieve arbitrary code execution on Adobe Campaign Classic servers, compromising campaign data, subscriber records, and adjacent systems within the changed scope.

Affected Products

Adobe Campaign Classic 7.4.3 builds 9394, 9396, 9397, 9398
Adobe Campaign Classic deployments on Linux
Adobe Campaign Classic deployments on Microsoft Windows

Discovery Timeline

2026-08-03 - CVE-2026-48317 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-48317

Vulnerability Analysis

Adobe Campaign Classic processes user-controllable input through a dynamic evaluation routine without sufficient sanitization. An authenticated attacker with low privileges submits crafted directives that the server interprets as executable code rather than data. The evaluator runs the injected payload inside the ACC application context, granting the attacker the same rights as the running user. Because scope changes during exploitation, code executed within the ACC process can affect resources managed by other security authorities, such as backend databases, credential stores, or connected marketing infrastructure. The Adobe advisory APSB26-120 categorizes the flaw as arbitrary code execution and lists it among the priority fixes for the August 2026 release cycle.

Root Cause

The root cause is improper neutralization of directives in dynamically evaluated code [CWE-95]. Adobe Campaign Classic accepts input that reaches an eval-style interpreter without escaping metacharacters or restricting the grammar of accepted expressions. Attackers embed executable statements inside fields the server expects to contain simple expressions or template values, and the evaluator executes them verbatim.

Attack Vector

The attack vector is network-based and requires an authenticated session with minimal privileges. An attacker submits a crafted request to an ACC endpoint that forwards content into the vulnerable evaluation routine. No user interaction is required. Successful exploitation yields arbitrary code execution and can pivot to systems outside the ACC trust boundary due to the scope change. No public proof-of-concept exploit or in-the-wild exploitation has been reported at the time of publication. See the Adobe Security Bulletin APSB26-120 for vendor-supplied technical details.

Detection Methods for CVE-2026-48317

Indicators of Compromise

Unexpected child processes spawned by the Adobe Campaign Classic server process on Linux or Windows hosts.
Anomalous outbound network connections from ACC servers to previously unseen destinations.
New or modified files under ACC application directories, especially scripts or executables written by the ACC service account.
ACC application logs showing malformed expressions, template errors, or evaluation exceptions from low-privileged accounts.

Detection Strategies

Inspect ACC HTTP request bodies and query parameters for script fragments, backticks, or interpreter metacharacters targeting expression fields.
Correlate authentication events for low-privileged ACC accounts with subsequent process creation events on the ACC host.
Baseline expected process lineage for the ACC service and alert on deviations such as shell, powershell.exe, or scripting interpreter execution.

Monitoring Recommendations

Forward ACC application logs, web server logs, and host process telemetry to a centralized analytics platform for correlation.
Monitor privileged actions performed by service accounts associated with Adobe Campaign Classic and flag unexpected privilege use.
Track file integrity of the ACC installation directory and configuration files to detect unauthorized modification.

How to Mitigate CVE-2026-48317

Immediate Actions Required

Apply the updates listed in Adobe Security Bulletin APSB26-120 to all Adobe Campaign Classic 7.4.3 deployments.
Audit ACC user accounts and revoke unnecessary low-privileged access that could be leveraged for authenticated exploitation.
Rotate credentials, API keys, and integration secrets stored on or reachable from ACC servers if compromise is suspected.

Patch Information

Adobe released fixed builds of Adobe Campaign Classic under advisory APSB26-120. Administrators should upgrade beyond the vulnerable 7.4.3 builds 9394, 9396, 9397, and 9398 to the version identified in the bulletin. Refer to the Adobe Security Bulletin APSB26-120 for exact fixed build numbers and upgrade guidance.

Workarounds

Restrict network access to ACC administrative interfaces to trusted management networks using firewall rules or reverse-proxy allowlists.
Enforce strong authentication and multi-factor authentication for all ACC operator accounts to reduce the pool of usable low-privileged sessions.
Review and disable ACC features that expose expression evaluation to non-administrative users where feasible until the patch is applied.

bash

# Example: restrict ACC web interface to a management subnet using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP