CVE-2026-48286
CRITICAL 10 ALL-YEARSAdobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Severe if exploited (CVSS 10), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
1.2%chance of exploitation in 30 days · 67th percentile
Impact if exploited
10CVSS 3.1 · CRITICAL · CNA
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Weakness (CWE)
- CWE-863: Incorrect Authorization (CWE-863)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References and research data (JSON)
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Adobe | Campaign | ≤ 7.4.3 |
All CVSS metrics
- CRITICAL 10 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CRITICAL 10 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
Advisories
- https://helpx.adobe.com/security/products/campaign/apsb26-69.html CVE record · adobe · Updated 2026-08-27T22:33:01.132Z
NVD · CVE-2026-48286 · Updated 2026-10-25T21:10:00.770 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40337 EUVD · EUVD-2026-40337
Sources: NVD · CVE.org · All sources and attribution · EPSS