CVE-2026-48449: Adobe Campaign Classic Critical RCE — Detection and Mitigation

Adobe has released out-of-band security patches addressing a critical vulnerability in Adobe Campaign Classic (ACC), an enterprise-grade marketing automation platform widely used by large organizations for campaign management. Tracked as CVE-2026-48449, this flaw carries a CVSS score of 10.0—the maximum possible severity.

The vulnerability stems from an "incorrect authorization" issue that allows an attacker to achieve arbitrary code execution without user interaction. In practical terms, this means an unauthenticated attacker on the network can potentially take complete control of the ACC server. Given the privileged access marketing platforms often hold to Personally Identifiable Information (PII) and their integration with internal CRM systems, this represents a high-value target for data theft and ransomware deployment. Defenders must treat this as a critical incident and prioritize patching immediately.

Technical Analysis

• Affected Product: Adobe Campaign Classic (ACC)
• Vulnerability ID: CVE-2026-48449
• CVSS Score: 10.0 (Critical)
• Vulnerability Type: Incorrect Authorization leading to Remote Code Execution (RCE)
• Impact: An attacker could execute arbitrary code on the underlying operating system hosting the ACC instance.

Mechanism of Attack: The flaw exists within the web interface or API handling of Campaign Classic. Due to improper authorization checks on a specific endpoint or function, a malicious actor can send a crafted request that bypasses authentication or permission gates. This interaction triggers a server-side process that executes commands under the context of the ACC service (typically running as a high-privilege user or root). Because no user interaction is required (e.g., clicking a link), this vulnerability is fully wormable in environments where ACC is internet-facing.

Exploitation Status: While the release of the advisory suggests the vulnerability was discovered through internal research or responsible disclosure, the CVSS 10.0 rating and the nature of "incorrect authorization" bugs mean that a Proof of Concept (PoC) exploit is likely to be developed rapidly by the threat community. Security teams must assume active scanning is imminent.

Detection & Response

Detecting exploitation of CVE-2026-48449 requires monitoring the ACC application processes for suspicious child activity. Since ACC runs on a Java-based application server (typically Tomcat), the primary indicator of compromise (IoC) is the Java process spawning an unauthorized shell or command interpreter.

Sigma Rules

The following Sigma rules monitor for the Adobe Campaign Classic process (often identified as java or the specific nlserver binary) spawning command-line interfaces on both Windows and Linux hosts.

---
title: Adobe Campaign Classic Java Process Spawning Windows Shell
id: 8a2b3c4d-1e2f-4a5b-8c7d-9e0f1a2b3c4d
status: experimental
description: Detects the Adobe Campaign Classic Java service spawning cmd.exe or powershell.exe, indicative of RCE exploitation (CVE-2026-48449).
references:
  - https://thehackernews.com/2026/08/adobe-campaign-classic-cvss-100-flaw.html
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\java.exe'
      - '\nlserver.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  condition: selection
falsepositives:
  - Legitimate administrative troubleshooting by the vendor support team
level: critical
---
title: Adobe Campaign Classic Java Process Spawning Linux Shell
id: 9c3d4e5f-2f3a-5b6c-9d8e-0f1a2b3c4d5e
status: experimental
description: Detects the Adobe Campaign Classic Java service spawning sh or bash on Linux, indicative of RCE exploitation (CVE-2026-48449).
references:
  - https://thehackernews.com/2026/08/adobe-campaign-classic-cvss-100-flaw.html
author: Security Arsenal
date: 2026/08/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
      - '/java'
      - '/nlserver'
    Image|endswith:
      - '/sh'
      - '/bash'
  condition: selection
falsepositives:
  - Legitimate administrative troubleshooting by the vendor support team
level: critical

KQL (Microsoft Sentinel / Defender)

This query hunts for suspicious parent-child process relationships involving the Java runtime typically used by Campaign Classic.

DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in~ ("java.exe", "nlserver", "java")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "zsh")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, CommandLine, FolderPath
| order by Timestamp desc

Velociraptor VQL

Use this artifact to hunt for unexpected child processes of the Adobe Campaign Classic Java processes on endpoints.

-- Hunt for Adobe Campaign Classic (Java) spawning shells
SELECT Parent.Name as ParentProcess, Pid, Name, CommandLine, Exe, Username, StartTime
FROM pslist()
WHERE Parent.Name =~ 'java'
   AND Name =~ '(cmd|powershell|pwsh|sh|bash|zsh)'

Remediation Script

Script Purpose: This Bash script assists in identifying the installed version of Adobe Campaign Classic on Linux systems to help validate if a patch has been applied. Note: ACC paths vary; adjust the ACC_PATH variable if necessary.

#!/bin/bash
# Adobe Campaign Classic Version Checker for CVE-2026-48449
# Default path for ACC is /usr/local/neolane/nlserver
ACC_PATH="/usr/local/neolane/nlserver"

if [ -f "$ACC_PATH" ]; then
    echo "[+] Adobe Campaign Classic binary found at $ACC_PATH"
    # Attempt to get version info (syntax may vary by build)
    $ACC_PATH -version 2>/dev/null || strings "$ACC_PATH" | grep -i "build\|version" | head -n 5
    echo "[!] Please verify the build number against Adobe Security Bulletin APSB26-XX."
else
    echo "[-] Adobe Campaign Classic not found at default path: $ACC_PATH"
    echo "Searching for 'nlserver' process..."
    pgrep -a nlserver
fi

Remediation

Immediate Actions:

1. Apply Patches Immediately: Adobe has released security updates to address this flaw. Navigate to the Adobe Experience Cloud Console and update Campaign Classic to the latest patched version specified in the security bulletin (APSB26-XX). Do not delay.
2. Network Segmentation: If patching is not immediately possible, restrict access to the ACC administrative interface and API endpoints. Ensure the server is behind a firewall that blocks internet traffic from non-essential IPs, and whitelist only trusted management IPs.
3. Review Logs: Conduct a retrospective review of web server logs (access.log) and system process logs for the period leading up to the patch application. Look for suspicious POST requests to non-standard endpoints or unauthorized process creation as detailed in the Detection section.
4. Inventory Assets: Identify all instances of Adobe Campaign Classic within your environment, including development and staging servers, as these are often missed and serve as easy entry points.

Vendor Advisory: Refer to the official Adobe Security Bulletin for the specific build numbers containing the fix: Adobe Security Bulletin

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub