What is the CVSS score of CVE-2026-48448?

CVE-2026-48448 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Adobe Campaign Classic are affected by CVE-2026-48448?

Adobe Campaign Classic contains an unauthenticated SQL injection vulnerability (CVSS 8.6) that permits remote attackers to read arbitrary files and extract sensitive data from affected servers.

How to fix or mitigate CVE-2026-48448?

Within 24 hours, inventory all exposed Adobe Campaign Classic instances and implement immediate network segmentation to restrict access from untrusted networks. Within 7 days, deploy Web Application Firewall rules targeting SQL injection patterns against ACC endpoints, enable database query logging and alerting for anomalous activity, and rotate credentials for all service accounts with ACC database access. Within 30 days, track vendor advisory updates for patch release, conduct forensic review of ACC access logs for signs of exploitation, and perform a security audit of sensitive files stored on or accessed by ACC systems.

Adobe Campaign Classic CVE-2026-48448

EUVD-2026-50956 HIGH

SQL Injection (CWE-89)

2026-07-30 psirt@adobe.com

GHSA-cpjx-wr9v-mhq4

SQLi Adobe Campaign

8.6

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Network-reachable unauthenticated SQLi needing no interaction (AV:N/AC:L/PR:N/UI:N); read-only file/memory disclosure crossing into OS resources gives S:C, C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 03:31 vuln.today

CVE Published

Jul 30, 2026 - 03:16 nvd

HIGH 8.6

DescriptionCVE.org

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to gain file system read access. Exploitation of this issue does not require user interaction. Scope is changed.

AnalysisAI

Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary files from the underlying host by exploiting an SQL injection flaw (CWE-89) that reaches file-system read primitives. Because the CVSS scope is changed and no user interaction is required, a single crafted request against an exposed ACC instance can leak sensitive memory and file contents (CVSS 8.6). There is no public exploit identified at time of analysis, but the network vector and low attack complexity make this a high-priority patch.

Technical ContextAI

Adobe Campaign Classic is an on-premise/hybrid enterprise marketing-automation and campaign-orchestration platform that runs an application tier backed by a relational database (typically PostgreSQL, Oracle, or MSSQL). The root cause is CWE-89, Improper Neutralization of Special Elements used in an SQL Command: user-controllable input is concatenated into a SQL query without adequate parameterization or escaping. In ACC this is significant because its query and data-import subsystems can interact with the file system, so the injection does not merely manipulate database rows - it is leveraged to obtain file-system read access and disclosure of sensitive memory. No CPE strings were provided in the intelligence, so exact affected package identifiers are not enumerated in this dataset and must be taken from the Adobe advisory.

RemediationAI

Patch available per vendor advisory: apply the fix from Adobe bulletin APSB26-114 (https://helpx.adobe.com/security/products/campaign/apsb26-114.html) as the primary remediation, as the exact patched build is enumerated there rather than in this dataset. Until the update is deployed, restrict network reachability of the ACC application and console - place it behind a VPN or IP allowlist and block direct internet exposure of the web/SOAP endpoints - since this both removes the AV:N unauthenticated path and has low functional side effects for internal-only deployments. As defense in depth for a SQL-injection-to-file-read flaw, ensure the ACC database service account runs with least privilege and, where supported, has file-system read functions (e.g. large-object or COPY-style file access) disabled; note this can break legitimate data-import jobs, so test in staging. Enable and monitor web/application logs for anomalous query patterns against ACC endpoints as a detective control while patching is scheduled.