What is the CVSS score of CVE-2026-48303?

CVE-2026-48303 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Adobe Campaign Classic are affected by CVE-2026-48303?

Adobe Campaign Classic (versions 7.4.3 and earlier) used by enterprises for marketing automation can be fully compromised by any network attacker without requiring credentials or user interaction.

How to fix or mitigate CVE-2026-48303?

24 hours: Identify and inventory all Adobe Campaign Classic deployments; confirm running build versions and assess network exposure (direct Internet access vs. internal-only). 7 days: Implement network-level access controls restricting ACC traffic to authorized sources only; deploy intrusion detection/prevention signatures for CVE-2026-48303; apply any vendor-released workarounds or hardening guidance. 30 days: Subscribe to Adobe Security Bulletins for patch availability; develop and test upgrade path to a patched version; conduct comprehensive audit log review for indicators of unauthorized access or exploitation attempts.

Adobe Campaign Classic CVE-2026-48303

EUVD-2026-35838 CRITICAL

Incorrect Authorization (CWE-863)

2026-06-09 psirt@adobe.com

GHSA-gx58-v339-c87j

Authentication Bypass Adobe RCE Campaign

10.0

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:35 vuln.today

CVE Published

Jun 09, 2026 - 21:17 nvd

CRITICAL 10.0

DescriptionCVE.org

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Articles & Coverage 2

News 19 New Adobe Vulnerabilities - 3 Critical, 16 High Severity Jun 10, 2026 News Critical RCE in Adobe Campaign Classic 7.4.3 - CVE-2026-48303 Jun 09, 2026

AnalysisAI

Remote code execution in Adobe Campaign Classic (ACC) version 7.4.3 build 9394 and earlier allows unauthenticated network attackers to execute arbitrary code in the context of the current user with no user interaction required. The flaw stems from an Incorrect Authorization weakness (CWE-863) and carries the maximum CVSS 3.1 base score of 10.0 with changed scope, indicating impact beyond the vulnerable component. No public exploit identified at time of analysis, though the perfect CVSS score and authentication-bypass characteristics make this a high-priority patch for any organization running ACC for marketing automation.

Technical ContextAI

Adobe Campaign Classic is an on-premises and hosted cross-channel marketing campaign management platform used by enterprises for email, SMS, push, and direct mail orchestration. The underlying weakness is CWE-863 (Incorrect Authorization), meaning the application performs an authorization check but the check is implemented incorrectly - typically permitting actions that should be restricted based on user role, session state, or resource ownership. Combined with the changed scope (S:C) in the CVSS vector, the authorization flaw allows an attacker to cross a trust boundary and execute code affecting resources beyond the originally vulnerable component, suggesting the flawed check gates a privileged code path (likely a server-side scripting, workflow, or JSSP/SOAP endpoint commonly exposed by ACC).

RemediationAI

Apply the Adobe-released patch documented in security bulletin APSB26-66 (https://helpx.adobe.com/security/products/campaign/apsb26-66.html), which addresses ACC 7.4.3 build 9394 and earlier - administrators should upgrade to the fixed build identified in that advisory (exact post-patch build number not enumerated in the input data and should be read from Adobe's bulletin). Until patching is complete, restrict network reachability to the ACC application server by placing it behind a VPN or IP allowlist so the unauthenticated network attack surface is removed, and audit ACC operator accounts and recent workflow/JSSP executions for anomalous activity given the authorization-bypass nature of the bug. Note that network restriction breaks any externally facing campaign tracking, form, or REST integration endpoints, so confirm which ACC services are public before blocking.