CVE-2026-48303

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/campaign/apsb26-66.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:adobe:campaign:::::classic:::*
	cpe:2.3:a:adobe:campaign:7.4.3:9394:::classic:::*

OR	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

23 Jul 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Las versiones 7.4.3 build 9394 y anteriores de Adobe Campaign Classic (ACC) están afectadas por una vulnerabilidad de autorización incorrecta que podría resultar en ejecución de código arbitrario en el contexto del usuario actual. La explotación de este problema no requiere interacción del usuario. El alcance ha cambiado.

12 Jun 2026, 15:02

Type	Values Removed	Values Added
First Time		Adobe Linux linux Kernel Microsoft windows Linux Microsoft Adobe campaign
References	~~() https://helpx.adobe.com/security/products/campaign/apsb26-66.html -~~	() https://helpx.adobe.com/security/products/campaign/apsb26-66.html - Vendor Advisory
CPE		cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:a:adobe:campaign:::::classic:::* cpe:2.3:a:adobe:campaign:7.4.3:9394:::classic:::*

09 Jun 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 21:17

Updated : 2026-07-23 09:10

NVD link : CVE-2026-48303

Mitre link : CVE-2026-48303

CVE.ORG link : CVE-2026-48303

JSON object : View

Products Affected

adobe

campaign

microsoft

windows

linux

linux_kernel

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-48303", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48303", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-10T13:24:20.580948Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Adobe Campaign Classic (ACC)", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "7.4.3 build 9394"}], "defaultStatus": "affected"}]}], "published": "2026-06-09T21:17:25.510", "references": [{"url": "https://helpx.adobe.com/security/products/campaign/apsb26-66.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed."}, {"lang": "es", "value": "Las versiones 7.4.3 build 9394 y anteriores de Adobe Campaign Classic (ACC) est\u00e1n afectadas por una vulnerabilidad de autorizaci\u00f3n incorrecta que podr\u00eda resultar en ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual. La explotaci\u00f3n de este problema no requiere interacci\u00f3n del usuario. El alcance ha cambiado."}], "lastModified": "2026-07-23T09:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "027E7401-BA58-41C4-886F-27A6F90EE635", "versionEndExcluding": "7.4.3"}, {"criteria": "cpe:2.3:a:adobe:campaign:7.4.3:9394:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "A6BFE9C0-BB34-4769-B94E-14E637695679"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@adobe.com"}