CVE-2026-48326: Adobe Campaign Classic RCE Vulnerability

CVE-2026-48326 Overview

Adobe Campaign Classic (ACC) contains a SQL injection vulnerability [CWE-89] that enables arbitrary code execution in the context of the current user. A low-privileged authenticated attacker can exploit the flaw over the network without user interaction. The CVSS scope is marked as changed, indicating impact extends beyond the vulnerable component. Adobe published the fix in Security Advisory APSB26-120. Affected releases include Adobe Campaign Classic versions up to and including 7.4.3 builds 9394, 9396, 9397, and 9398 on both Windows and Linux platforms.

Critical Impact
A low-privileged attacker can inject SQL commands that trigger arbitrary code execution on the Adobe Campaign Classic server, compromising confidentiality, integrity, and availability across the environment.

Affected Products

Adobe Campaign Classic 7.4.3 builds 9394, 9396, 9397, and 9398
Adobe Campaign Classic deployments on Microsoft Windows
Adobe Campaign Classic deployments on Linux

Discovery Timeline

2026-08-03 - CVE-2026-48326 published to the National Vulnerability Database
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-48326

Vulnerability Analysis

Adobe Campaign Classic improperly neutralizes special elements passed to SQL commands. Attacker-supplied input reaches the database query layer without adequate sanitization or parameterization. This allows an authenticated user with minimal privileges to alter query structure and execute attacker-controlled SQL statements.

Because the CVSS scope is changed, successful exploitation impacts resources beyond the vulnerable component. Adobe describes the outcome as arbitrary code execution in the context of the current user, meaning attackers can move from SQL injection to command execution on the underlying host. This class of flaw commonly leverages database features such as extended stored procedures or file-system access to bridge from data-tier compromise to operating-system compromise.

Root Cause

The root cause is Improper Neutralization of Special Elements used in an SQL Command [CWE-89]. User-controlled parameters are concatenated into SQL statements without prepared statements or parameter binding. The application trusts input from authenticated sessions and forwards it to the database driver as part of a dynamically constructed query string.

Attack Vector

Exploitation requires network access to the Adobe Campaign Classic interface and a low-privileged account. No user interaction is needed. An attacker submits a crafted request containing SQL metacharacters through an exposed workflow, API endpoint, or console operation. The malicious payload modifies the intended query, then leverages database-to-OS primitives to run code on the server. Adobe has not disclosed the specific endpoint, and no public proof-of-concept exploit is available at the time of publication.

See the Adobe Security Advisory APSB26-120 for vendor-supplied technical details.

Detection Methods for CVE-2026-48326

Indicators of Compromise

Unexpected SQL syntax such as UNION SELECT, stacked queries, or comment sequences (--, /*) in Adobe Campaign application logs
New or unusual child processes spawned by the Adobe Campaign service account, including shells, scripting interpreters, or cmd.exe
Database audit entries showing use of extended stored procedures or file-system functions initiated from the Campaign application user
Outbound network connections from the Campaign server to unfamiliar hosts shortly after low-privileged account activity

Detection Strategies

Enable database-side query logging and alert on syntactically anomalous queries from the Campaign application account
Correlate authentication events for low-privileged Campaign users with subsequent process creation on the host
Baseline normal Campaign workflow execution and flag deviations in request parameters that contain SQL metacharacters

Monitoring Recommendations

Forward Adobe Campaign application logs, database audit logs, and host process telemetry to a centralized analytics platform for correlation
Monitor for privilege changes, new local accounts, or scheduled tasks created on Campaign servers after the CVE publication date
Track egress traffic from Campaign hosts and alert on connections to non-approved destinations

How to Mitigate CVE-2026-48326

Immediate Actions Required

Apply the security update referenced in Adobe Security Advisory APSB26-120 to all Adobe Campaign Classic instances
Inventory Campaign Classic deployments and confirm build numbers against the vulnerable versions 7.4.3 builds 9394, 9396, 9397, and 9398
Audit low-privileged Campaign accounts for unexpected access, disable dormant accounts, and rotate credentials
Review database service account permissions and remove unnecessary OS-level capabilities such as xp_cmdshell where feasible

Patch Information

Adobe released fixed builds through Security Advisory APSB26-120. Administrators should follow the vendor's upgrade guidance and validate the patched build number after installation. Confirm that both application binaries and any bundled database components are updated. See Adobe Security Advisory APSB26-120 for exact patched versions and installation procedures.

Workarounds

Restrict network access to the Adobe Campaign Classic console and APIs using firewall rules or a reverse proxy that enforces IP allow-listing
Apply web application firewall signatures that block common SQL injection payloads targeting Campaign endpoints until patching completes
Enforce least privilege on the database account used by Adobe Campaign, removing rights that enable command execution or file-system access

bash

# Example: restrict Adobe Campaign console access to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP