CVE-2026-48330: Adobe Campaign Classic SQLi Vulnerability

CVE-2026-48330 Overview

Adobe Campaign Classic (ACC) contains a SQL injection vulnerability [CWE-89] that allows unauthenticated attackers to execute arbitrary SQL commands against the application backend. Successful exploitation can lead to arbitrary code execution in the context of the current user, elevated database access, and full compromise of the campaign management platform. The flaw is exploitable over the network without authentication or user interaction, and the CVSS scope is changed, meaning impact extends beyond the vulnerable component. Adobe published advisory APSB26-120 addressing the issue across affected 7.4.3 builds of Campaign Classic on both Linux and Windows deployments.

Critical Impact
Unauthenticated remote attackers can inject arbitrary SQL and execute code in the current user context, with scope change extending impact to adjacent components.

Affected Products

Adobe Campaign Classic 7.4.3 builds 9394, 9396, 9397, and 9398
Adobe Campaign Classic deployments on Linux
Adobe Campaign Classic deployments on Microsoft Windows

Discovery Timeline

2026-08-03 - CVE-2026-48330 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-48330

Vulnerability Analysis

The vulnerability is an Improper Neutralization of Special Elements used in an SQL Command [CWE-89] within Adobe Campaign Classic. User-controlled input reaches SQL query construction without adequate sanitization or parameterization. An attacker submits crafted input that alters query semantics, enabling arbitrary SQL execution against the backing database.

Because Campaign Classic executes stored procedures and server-side logic tied to database operations, successful injection escalates to arbitrary code execution in the context of the current user. The scope change indicated in the CVSS vector means the vulnerable component can impact resources managed by a different security authority, such as the underlying operating system or adjacent services.

Exploitation requires no authentication and no user interaction. Any network-reachable Campaign Classic instance running an affected 7.4.3 build is exposed. Refer to the Adobe Security Advisory APSB26-120 for vendor technical details.

Root Cause

The root cause is missing or insufficient input neutralization on parameters incorporated into SQL statements. Query construction concatenates untrusted data rather than binding values through parameterized statements, allowing metacharacters to break out of the intended query context.

Attack Vector

The attack vector is network-based against exposed Campaign Classic endpoints. An attacker sends a crafted HTTP request containing SQL syntax within an injectable parameter. The server executes the modified query, returning data, modifying records, or invoking database features that lead to code execution on the host.

No verified public exploit code is available at the time of publication. Defenders should treat internet-exposed Campaign Classic instances as high-priority remediation targets.

Detection Methods for CVE-2026-48330

Indicators of Compromise

HTTP requests to Campaign Classic endpoints containing SQL metacharacters such as ', --, ;, UNION SELECT, or encoded variants in query parameters or POST bodies
Unexpected database errors, long-running queries, or anomalous stored procedure invocations in Campaign Classic database logs
New or modified administrative accounts, scheduled tasks, or files created by the Campaign Classic service account
Outbound connections from Campaign Classic hosts to unknown external addresses following suspicious inbound traffic

Detection Strategies

Deploy web application firewall (WAF) rules to identify SQL injection patterns targeting Campaign Classic URIs
Enable database query logging and alert on queries originating from Campaign Classic that contain suspicious clauses or reference system tables
Correlate inbound HTTP requests with subsequent process creation events on Campaign Classic servers to identify code execution
Baseline normal Campaign Classic HTTP traffic and alert on deviations in parameter length, encoding, or content

Monitoring Recommendations

Ingest Campaign Classic web server, application, and database logs into a centralized SIEM for correlation
Monitor the Campaign Classic service account for unexpected shell activity, file writes, or lateral movement attempts
Track authentication events on the database backend for logins outside expected application service accounts

How to Mitigate CVE-2026-48330

Immediate Actions Required

Apply the patched Campaign Classic build referenced in Adobe Security Advisory APSB26-120 as a priority
Inventory all Campaign Classic instances on both Linux and Windows and confirm build numbers against affected 7.4.3 versions
Restrict network access to Campaign Classic management and API endpoints to trusted networks and VPN-only paths
Rotate database credentials, API keys, and administrative passwords used by Campaign Classic after patching

Patch Information

Adobe released fixed builds addressing CVE-2026-48330 in advisory APSB26-120. Administrators running Campaign Classic 7.4.3 builds 9394, 9396, 9397, or 9398 must upgrade to the vendor-specified fixed release. See the Adobe Security Advisory APSB26-120 for exact fixed build numbers and upgrade procedures.

Workarounds

Place Campaign Classic behind a WAF configured to block SQL injection payloads until patches are applied
Enforce least-privilege database accounts so the Campaign Classic service cannot execute administrative SQL or operating system commands
Disable or firewall-block external access to non-essential Campaign Classic interfaces during the remediation window

bash

# Example WAF rule concept blocking SQL metacharacters on Campaign Classic endpoints
# (adapt to your WAF syntax - ModSecurity example)
SecRule REQUEST_URI "@beginsWith /nl/" \
    "chain,phase:2,deny,status:403,id:1002026,msg:'Potential SQLi against Adobe Campaign Classic (CVE-2026-48330)'"
    SecRule ARGS "@rx (?i)(union(\s|/\*.*\*/)+select|;\s*(drop|insert|update|delete)\b|--\s|/\*.*\*/)" "t:none,t:urlDecodeUni"