Adobe Campaign Classic Vulnerability Allows Arbitrary Code Execution

Adobe has disclosed a critical security issue affecting its Enterprise Marketing Automation Platform, Campaign Classic (ACC). The flaw, identified as CVE-2026-48449, carries a maximum severity score of 10.0 on the Common Vulnerability Scoring System (CVSS) ¹.

The vulnerability stems from an authorization bypass that permits arbitrary command execution without valid credentials. An attacker only needs to visit a website linked to ACC to trigger malicious actions on the underlying server infrastructure ¹.

This type of flaw mirrors past incidents such as Apache Struts’ CVE‑2017‑5806, which enabled widespread ransomware attacks. Unlike the rapid system-wide spread seen with Struts, the current exploit appears confined to specific deployments of Campaign Classic but still poses significant risk for lateral movement into other enterprise resources tied to customer relationship management workflows ¹.

Adobe has released patches addressing the issue and urges all customers running ACC to apply them immediately. Failure to update leaves organizations vulnerable not only to remote access but also potential privacy breaches across connected systems ¹.