#202020

Adobe Security Bulletin

Last updated on Aug 11, 2026

Security update available for Adobe Campaign Classic | APSB26-120

Bulletin ID
Date published
Priority
APSB26-120
August 3, 2026
1
style
grid width 12

Summary

Adobe has released a security update for Adobe Campaign Classic. This update addresses critical vulnerabilities that could result in arbitrary code execution.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected versions

Product
Affected version
Platform
Adobe Campaign Classic
ACC v7: 7.4.3 build 9398 and earlier
Windows, Linux
style
grid width 12

Solution

Adobe categorizes these updates with the following priority rating and recommends users update their installation to the newest version:

Product
Updated version
Platform
Priority rating
Availability
Adobe Campaign Classic
ACC v7 7.4.3 build 9399
Windows, Linux
1
Release Notes
style
grid width 12

Note

This security bulletin applies only to fully on-premise deployments of Adobe Campaign Classic and to the on-premise components of hybrid deployments. Adobe-hosted instances have already been remediated and require no customer action.

style
xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Vulnerability Details

CVE-2026-48331
Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-48323
Vulnerability category: Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-48330
Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE-2026-48326
Vulnerability category: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.9
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2026-48333
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Privilege escalation
Severity: Critical
CVSS base score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-48317
Vulnerability category: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 9.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVE-2026-48399
Vulnerability category: Violation of Secure Design Principles (CWE-657)
Vulnerability impact: Security feature bypass
Severity: Critical
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

style
xl spacing, one up, grid width 12, static-links, xxl-spacing-top

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle
APSB26-120
CardDescription
Priority 1 Security update
CardImage
Adobe
Created
2026-08-03
Tags
caas:content-type/documentation,caas:trust-center/security-bulletin,caas:products/adobe-campaign
PrimaryTag
caas:content-type/article
Details
caas:mnemonics/adobe-campaign
Arbitrary
search: CVE-2026-48331 CVE-2026-48323 CVE-2026-48330 CVE-2026-48326 CVE-2026-48333 CVE-2026-48317 CVE-2026-48399