What is the CVSS score of CVE-2026-48286?

CVE-2026-48286 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Adobe Campaign Classic are affected by CVE-2026-48286?

Adobe Campaign Classic versions 7.4.3 build 9396 and earlier contain a critical remote code execution vulnerability allowing unauthenticated attackers to bypass authorization controls and execute…

How to fix or mitigate CVE-2026-48286?

Within 24 hours: Inventory all ACC deployments and identify systems running version 7.4.3 build 9396 or earlier; implement network segmentation to restrict ACC access to trusted internal networks only; enable detailed logging of all authentication and authorization events. Within 7 days: Deploy Web Application Firewall rules to detect and block authorization-bypass attempts targeting ACC endpoints; disable unnecessary network-exposed ACC services where operationally feasible; conduct complete access control audit of ACC administrative privileges. Within 30 days: Monitor Adobe security advisories continuously for patch release; develop and test ACC upgrade plan for immediate deployment when patch becomes available; if no patch timeline is announced, assess business continuity impact and evaluate alternative campaign management platforms.

Adobe Campaign Classic CVE-2026-48286

EUVD-2026-40337 CRITICAL

Incorrect Authorization (CWE-863)

2026-06-30 adobe

GHSA-f44v-356v-7qcf

Authentication Bypass Adobe RCE Adobe Campaign Classic Acc

10.0

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Network-reachable authorization bypass needing no auth or interaction yields PR:N/UI:N/AC:L, and code execution crossing the component boundary justifies S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 16:22 vuln.today

CVE Published

Jun 30, 2026 - 15:08 nvd

CRITICAL 10.0

DescriptionCVE.org

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Articles & Coverage 1

News Critical RCE in Adobe Campaign Classic 7.4.3 - CVE-2026-48286 Jun 30, 2026

AnalysisAI

Remote code execution in Adobe Campaign Classic (ACC) version 7.4.3 build 9396 and earlier allows unauthenticated attackers to bypass authorization controls and run arbitrary code in the context of the current user. The flaw stems from an incorrect authorization check (CWE-863) reachable over the network with no user interaction, and the changed scope means impact can extend beyond the vulnerable component. It carries a maximum CVSS 10.0 rating; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Adobe Campaign Classic is an on-premises/hybrid marketing automation and cross-channel campaign management platform that exposes web-facing application server endpoints and a SOAP/HTTP API. The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning an authorization decision is performed but uses a flawed check, allowing an action to proceed when it should be denied. Per the CPE (cpe:2.3:a:adobe:adobe_campaign_classic_(acc):*) this affects the Adobe Campaign Classic application across versions up to and including 7.4.3 build 9396. Combined with the 'arbitrary code execution' outcome and a changed CVSS scope (S:C), the broken authorization likely permits an attacker to reach privileged server-side functionality that can execute code, with consequences crossing the original security boundary (e.g., from the application layer into the underlying host or adjacent components).

RemediationAI

Patch available per vendor advisory: upgrade Adobe Campaign Classic to the fixed release identified in Adobe Security Bulletin APSB26-69 (https://helpx.adobe.com/security/products/campaign/apsb26-69.html), as builds at or below 7.4.3 build 9396 are vulnerable; the exact patched build should be confirmed directly from that bulletin before deployment as a specific fix version was not included in the provided data. Until the upgrade is applied, reduce exposure by restricting network access to the Adobe Campaign application and API endpoints - place the server behind a VPN or IP allowlist and block direct internet access to the management/SOAP interfaces, accepting that this may disrupt remote operators or integrated external channels that legitimately call those endpoints. Monitor application and web-server logs for anomalous authorization-bypass patterns and unexpected code-execution or process-spawn activity from the ACC service account as a detective control while patching is scheduled.