CVE-2026-48303: Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until a vendor fix is available and applied, restrict network access to vulnerable ACC instances: isolate them on internal networks, limit access to trusted IPs via firewall/ACLs, and block public/internet access to management interfaces.
- Operational
Inventory and identify all Adobe Campaign Classic (ACC) installations in your environment. Confirm product versions; treat any instance running version 7.4.3 build 9394 or earlier as vulnerable.
- Operational
Monitor vulnerable ACC instances for signs of compromise (suspicious process execution, unexpected code execution, or anomalous network activity). If compromise is suspected, isolate affected systems and rotate any credentials or secrets that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48303?
The severity of CVE-2026-48303 is rated as critical with a score of 10.
What vulnerabilities does CVE-2026-48303 exploit?
CVE-2026-48303 exploits an Incorrect Authorization vulnerability in Adobe Campaign Classic.
How do I mitigate CVE-2026-48303?
To mitigate CVE-2026-48303, upgrade to Adobe Campaign Classic version 7.4.4 or later.
What are the potential impacts of CVE-2026-48303?
Exploitation of CVE-2026-48303 can lead to arbitrary code execution in the context of the current user.
Does CVE-2026-48303 require user interaction for exploitation?
No, CVE-2026-48303 can be exploited without any user interaction.