Adobe Campaign Classic Critical Vulnerability Puts Enterprise Marketing Data at Risk

What the CVSS 10.0 Score on Adobe Campaign Classic Vulnerability Actually Means

Adobe has issued emergency security patches for a maximum-severity vulnerability in Campaign Classic (ACC), its enterprise-grade marketing automation platform. The flaw, tracked as CVE-2026-48449, carries a perfect CVSS score of 10.0 — the highest possible rating on the Common Vulnerability Scoring System — and could allow an attacker to execute arbitrary code on affected systems without requiring any interaction from a logged-in user. For IT decision makers and privacy professionals managing enterprise marketing infrastructure, this is the kind of alert that warrants immediate attention.

A CVSS 10.0 is not handed out routinely. It signals that the vulnerability is remotely exploitable, requires no authentication, involves no user interaction, and has the highest possible impact on confidentiality, integrity, and availability. In plain terms: if your organisation is running an unpatched version of Adobe Campaign Classic, a remote attacker could theoretically take control of the system and access or manipulate the data it holds — including customer contact data, campaign lists, and behavioural analytics that are frequently subject to GDPR obligations.

The vulnerability has been classified as an incorrect authorization flaw. This category of bug means the software fails to properly verify that a request is authorised before executing it — effectively opening a door that should be locked. Adobe stated in its advisory that it is not currently aware of any exploitation in the wild, but given the severity of the flaw and the prominence of Campaign Classic as a tool used by large enterprises across Europe and beyond, security teams should treat this as urgent.

Beyond the Headline: The Full Scope of Adobe's Security Patch Release

While CVE-2026-48449 is grabbing the headlines, Adobe's patch release addresses a broader set of vulnerabilities that collectively paint a concerning picture of the attack surface in widely deployed Adobe products. The update for Campaign Classic also resolves CVE-2026-48448, a high-severity SQL injection flaw with a CVSS score of 8.6. SQL injection vulnerabilities of this type can allow attackers to query or extract arbitrary files from the underlying file system — a significant risk when Campaign Classic is managing structured databases of customer records that organisations are legally required to protect under regulations like GDPR.

Both Campaign Classic flaws have been patched in ACC v7, specifically build 7.4.3 (build 9398), available for both Windows and Linux environments. Organisations that rely on Campaign Classic in hybrid or multi-cloud infrastructure — particularly those with deployments spanning EU data centres — should verify their version and apply the update immediately.

Adobe also simultaneously released patches addressing eight critical-rated vulnerabilities in Adobe Bridge, a digital asset management application widely used by creative and marketing teams. These flaws span several vulnerability classes:

The breadth of this disclosure — ten vulnerabilities across two products in a single release — underscores a pattern that security researchers at organisations like the SANS Institute have highlighted: enterprise software suites with large, interconnected codebases tend to accumulate technical debt in their security architecture, making periodic patch releases significant in scope when they do arrive.

Why This Adobe Campaign Classic Vulnerability Is a GDPR and Data Sovereignty Problem

For European organisations and those handling EU citizen data, the implications of this Adobe Campaign Classic vulnerability extend well beyond a standard IT patching exercise. Adobe Campaign Classic is a tool designed to process, segment, and act on large volumes of personal data — email addresses, behavioural profiles, purchase histories, and communication preferences. Under the General Data Protection Regulation (GDPR), organisations are required to implement "appropriate technical and organisational measures" to protect personal data (Article 32). Running unpatched software with a known CVSS 10.0 flaw is, by almost any reasonable interpretation, a failure to meet that standard.

If an attacker were to exploit CVE-2026-48449 before an organisation applied the patch, the consequences could include a full breach of the Campaign Classic database — triggering mandatory breach notification requirements under GDPR Article 33, which requires notification to the relevant supervisory authority within 72 hours of becoming aware of a breach. Depending on the scale of data involved, fines under GDPR can reach up to 4% of global annual turnover or €20 million, whichever is higher. According to enforcement data tracked by GDPR Enforcement Tracker, penalties for inadequate security measures have been among the most consistently applied across EU member states.

This is also a data sovereignty concern for organisations that have invested in keeping customer data within EU jurisdiction. If a vulnerability in an enterprise platform allows unauthorised access, the jurisdictional controls and contractual safeguards around data residency become largely academic. The physical location of a server matters little if the software running on it can be remotely compromised.

Breaking Down the Attack Vectors: What These Vulnerability Types Actually Mean for Your Infrastructure

For developers and IT professionals who need to communicate the risk upward to leadership, understanding the specific vulnerability categories involved is essential. This patch release covers several distinct classes of security weaknesses, each with different risk profiles.

Incorrect Authorization (CVE-2026-48449, CVE-2026-48396, CVE-2026-48390): These flaws occur when an application does not properly verify that the entity making a request has the right to perform the requested action. In the context of Campaign Classic, this could mean that an unauthenticated or low-privileged user — or even a remote actor — can trigger actions that should be restricted to administrators. The fact that CVE-2026-48449 requires no user interaction makes it particularly dangerous, as it could be exploited in automated, large-scale attacks.

SQL Injection (CVE-2026-48448): A classic and persistently relevant attack vector. SQL injection remains one of the most exploited vulnerability classes in web-facing enterprise applications, as consistently documented by the OWASP Top Ten. In this case, the flaw could enable an attacker to read arbitrary files from the file system — potentially exposing configuration files, credentials, or other sensitive data stored on the server.

Untrusted Search Path (CVE-2026-48395, CVE-2026-48391): These vulnerabilities occur when an application searches for executables or libraries in locations that an attacker can influence. By placing a malicious executable in a predictable path, an attacker can trick the application into running it instead of the legitimate binary — a technique sometimes used in privilege escalation chains.

Originally reported by RSS App New Cybersecurity Feed. Summarised and curated by European Purpose.