CVE Intelligence
Analysis AI-assisted

CVE-2026-48286: Adobe Campaign Classic Incorrect Authorization (CWE-863) Vulnerability

CVE-2026-48286 is an Incorrect Authorization weakness (CWE-863) in Adobe Campaign Classic (ACC) 7.4.3 build 9396 and earlier, which the record says could allow arbitrary code execution in the context of the current user. The CNA rates it critical with a CVSS 3.1 base score of 10 and no user interaction required. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

An Incorrect Authorization weakness (CWE-863) in Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier could allow arbitrary code execution in the context of the current user, according to the record. The record states that exploitation does not require user interaction and that the scope is changed.

Impact

  • The CNA reports a CVSS 3.1 base score of 10 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
  • The vector rates confidentiality, integrity and availability impacts as high.
  • Code would run with the privileges of the current user, so the real effect depends on the account and deployment.

Affected products and versions

  • Adobe Campaign, versions up to and including 7.4.3 build 9396 (recorded as a range of 7.4.3 and earlier).
  • The record lists no fixed version. Check the Adobe security bulletin APSB26-69 for current guidance.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted for this analysis. The record includes an EPSS probability of 0.01166 and a percentile of 0.66484.

Remediation and mitigation

  • Review the vendor bulletin and apply the update Adobe provides for Adobe Campaign Classic as soon as it is available for your version.
  • Until a fix is applied, limit network exposure of ACC servers and restrict who can reach administrative and integration interfaces.
  • Review authorization settings and role assignments in the environment.
  • Give this asset high priority because of the critical score, while following the vendor's guidance.

Detection guidance

  • Review logs for unexpected administrative actions, newly created or changed accounts, and unusual process activity on ACC hosts.
  • Monitor for access to ACC services from networks that should not reach them.
  • Keep logging of authorization failures and privilege changes enabled.

Limitations of the available information

The record has no fixed version, no technical details beyond the description, no exploitation evidence, and no CVSS source other than the CNA. The vendor bulletin was only identified as a reference and its contents were not verified in this analysis.

Frequently asked questions

What is CVE-2026-48286?

It is an Incorrect Authorization weakness (CWE-863) in Adobe Campaign Classic 7.4.3 build 9396 and earlier. According to the record, it could allow arbitrary code execution in the context of the current user.

Does exploitation require user interaction?

The record states that exploitation does not require user interaction. The CVSS vector reports UI:N.

Is this CVE known to be exploited in the wild?

No. The CISA KEV catalog does not list it in the record, and no confirmed exploitation appears in the sources consulted.

Is there a fixed version?

The record lists no fixed version. Check the Adobe bulletin APSB26-69 for current remediation guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.