Adobe Campaign Classic

Adobe August 2026 Patch Day: ColdFusion ships a CVSS 10.0 unauthenticated OS command injection, and Campaign Classic ships two more unauthenticated CVSS 10.0 flaws in the same release

Adobe's 2026-08-11 Security Patch Day carries two bulletins whose headline flaws are unauthenticated, no-interaction paths to arbitrary code execution at CVSS 10.0. APSB26-90 fixes 16 CVEs in ColdFusion 2025 (≤2025.0.11) and 2023 (≤2023.0.22), led by CVE-2026-48362 (CWE-78, OS command injection, CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) (unauthenticated arbitrary code execution) and CVE-2026-48273 (CWE-95, eval injection, 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), which needs low-privileged access rather than none (Adobe, APSB26-90, 2026-08-11). The remaining fourteen span incorrect-authorization application denial-of-service (CVE-2026-71384, 9.6), cross-site scripting escalating to code execution (CVE-2026-71386, 8.8), privilege escalation via input validation (CVE-2026-21273, 8.7), further authorization and hard-coded-key defects down to CVSS 4.9, and a heap-based buffer overflow (CVE-2026-48440, 8.1). Adobe states it is "not aware of any exploits in the wild for any of the issues addressed in this update," and separately recommends keeping the underlying JDK/JRE current and reviewing its serialFilter guidance for insecure deserialization (Adobe, APSB26-90, 2026-08-11).

APSB26-123 covers Adobe Campaign Classic, explicitly scoped to on-premise deployments and the on-premise leg of hybrid deployments, since "Adobe-hosted instances have already been remediated and require no customer action" (Adobe, APSB26-123, 2026-08-11). Two of its three fixed CVEs are unauthenticated CVSS 10.0 incorrect-authorization flaws reaching arbitrary code execution (CVE-2026-71398 and CVE-2026-27302, the same vector under two identifiers) and the third, CVE-2026-48381 (CWE-89, SQL injection, 9.0, AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), is unauthenticated with high attack complexity. All three are fixed in ACC v7 7.4.4 build 9400 for both Windows and Linux; the earlier 7.4.3 build 9399 and prior are affected. No exploitation is reported for either bulletin, and neither Adobe advisory names a researcher, which is consistent with an internally-found batch.

Detection, in vendor-neutral terms: ColdFusion's command-injection path and Campaign Classic's authorization flaws both reach the underlying host or database with no prior authentication, so the durable telemetry is process-lineage and query-shape anomalies rather than an authentication event, a ColdFusion application-server process spawning an OS shell or interpreter with no corresponding administrative session, and Campaign Classic database queries or file operations issued outside the product's own scheduled and interactive-session patterns. Because no public proof-of-concept or exploitation report exists yet for either bulletin, the defensible position is to treat the patch window itself as the exposure window and close it before a diff-derived exploit appears, rather than waiting for confirmed activity.

Adobe Campaign Classic APSB26-120, three more unauthenticated CVSS 10.0 code-execution flaws, and last week's build 9398 is the version they affect

Five days after Adobe fixed two critical unauthenticated flaws in Campaign Classic with build 9398, APSB26-114, dated 2026-07-29, also a Priority 1 update (Adobe PSIRT, 2026-07-29), it published a second bulletin whose affected range includes build 9398. APSB26-120, dated 2026-08-03, covers seven vulnerabilities in the on-premise campaign-management platform and records the affected versions as "ACC v7: 7.4.3 build 9398 and earlier", fixed in ACC v7 7.4.3 build 9399, at Adobe's highest priority rating of 1 (Adobe PSIRT, 2026-08-03). Any operator who treated last week's build as the end state (which is what the previous advisory called for) is still carrying every flaw below.

Three of the seven need no authentication and no user interaction, each scored CVSS 10.0 with changed scope (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and each independently sufficient for arbitrary code execution per Adobe's own impact column: CVE-2026-48331, a server-side request forgery (CWE-918); CVE-2026-48323, improper neutralization of special elements used in a template engine (CWE-1336); and CVE-2026-48330, a SQL injection (CWE-89). Four more carry a precondition: CVE-2026-48326 (CVSS 9.9) is a second SQL injection reaching code execution but requiring low privileges; CVE-2026-48333 (CVSS 9.8) is an incorrect-authorization flaw (CWE-863) giving unauthenticated privilege escalation; CVE-2026-48317 (CVSS 9.6) is an eval injection (CWE-95) needing low privileges; and CVE-2026-48399 (CVSS 7.5) is a violation of secure design principles (CWE-657) yielding a security-feature bypass. Adobe rates all seven Critical and states that it "is not aware of any exploits in the wild for any of the issues addressed in these updates" (Adobe PSIRT, 2026-08-03). NCSC-NL relayed the bulletin on 2026-08-06 and is explicit that it is not an update of its own earlier Campaign Classic advisory but a separate set of newly found vulnerabilities (NCSC-NL, 2026-08-06).

Exposure is a question of who runs their own instance: the bulletin "applies only to fully on-premise deployments of Adobe Campaign Classic and to the on-premise components of hybrid deployments", with Adobe-hosted instances already remediated and needing no customer action (Adobe PSIRT, 2026-08-03). This is the third distinct wave of critical unauthenticated code-execution-class disclosures against this product line since late June (Adobe PSIRT, 2026-07-29), each at Adobe's top priority, which is itself the planning signal, a platform producing pre-auth CVSS-10.0 flaws on a roughly weekly cadence is one to move off the public internet rather than one to keep patching in place. Detection concepts, telemetry class first: with no public proof-of-concept and no reported exploitation, version state is the only reliable check, so inventory on-premise ACC instances against build 9399 rather than waiting for exploitation telemetry; where the application server's outbound traffic is logged, unexpected egress initiated by the ACC process is the observable class the SSRF would produce, and unexpected child processes spawned by the web or template-rendering service is what the template-injection and eval-injection paths would produce. Both are behavioural classes derived from the flaw types Adobe names, not from any reported intrusion, no cited source describes an actual attack against these CVEs, so nothing here should be read as a hunt for known activity. One bookkeeping change worth noting for anyone who tracks Adobe CVE counts: the bulletin states that effective 2026-08-11, Adobe may assign a single CVE identifier to internally discovered vulnerabilities sharing a severity rating and CWE category when a release includes systemic fixes, so future counts will understate flaw counts relative to this one.

CVE-2026-48449, Adobe Campaign Classic: an authorization flaw gives unauthenticated arbitrary code execution (CVSS 10.0), on-premise and hybrid deployments only

This is a recovery published by the 2026-08-02 weekly quality audit: the bulletin landed inside the audit window and no entry covered it.

The number that decides the timeline here is not the 10.0 but the vector. Adobe's own table gives CVE-2026-48449 as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (network reachable, low complexity, no privileges required, no user interaction, scope changed) against an Incorrect Authorization weakness (CWE-863) whose impact Adobe records as arbitrary code execution (Adobe, 2026-07-29). An authorization flaw reached without credentials on an internet-facing application is the shape that does not wait for the quarterly window, and Adobe agrees to the extent its own scale allows: it assigns priority rating 1, its most urgent. The sibling CVE-2026-48448 is a SQL injection at CVSS 8.6 with the same PR:N/UI:N prefix, impact recorded as arbitrary file-system read.

The scoping note is the part most likely to be misread in an estate inventory. Adobe states that "This security bulletin applies only to fully on-premise deployments of Adobe Campaign Classic and to the on-premise components of hybrid deployments"; Adobe-hosted instances were remediated by Adobe and need no customer action. A hybrid deployment is the trap: the hosted half is already fixed while the on-premise half is not, so an organisation whose asset register records Campaign as a SaaS product will conclude wrongly that it has nothing to do. Adobe also states it "is not aware of any exploits in the wild for any of the issues addressed in these updates", which is the correct hedge to carry; this entry is about mechanics and exposure, not about observed attacks.

What makes Campaign Classic worth the attention beyond the score is what it holds and what it touches. It is a campaign-execution platform: marketing and citizen-communication databases, subscriber lists, personal contact data, and an outbound sending capability tied to the organisation's own domain. Code execution on that host is simultaneously a personal-data exposure and a trusted-sender takeover, and public-sector bodies using it for citizen notifications inherit both.

Triage: there is no published exploitation and no proof-of-concept, so there is no attack pattern to match yet. What can be checked now is retrospective and cheap: on an ACC host that was internet-reachable while below build 9398, review the application and web-server logs for requests reaching authenticated functionality without a preceding successful authentication event, and for process creation under the ACC service account with a web-server parent; those are the generic manifestations an authorization bypass reaching code execution would produce, and their absence over the exposure window is a meaningful negative on a host with no other exposure.