🔨 Adobe Campaign Classic (CVE-2026-48449): CVSS 10.0 RCE Without User Interaction

Just caught the breaking news on CVE-2026-48449 affecting Adobe Campaign Classic (ACC). It’s not every day we see a CVSS 10.0 drop, especially in a marketing automation platform.

According to the advisory, this is an incorrect authorization vulnerability that allows for arbitrary code execution. The kicker? It requires no user interaction. If your ACC instance is exposed, this about as critical as it gets. The flaw essentially bypasses standard authorization checks, likely allowing an unauthenticated attacker to send crafted requests to the application server.

Mitigation & Detection

If you are on-prem, patch immediately. For those of us stuck waiting for change windows, we need visibility.

Since ACC usually runs as a service (often nlserver on Windows/Linux), keep an eye on unexpected child processes. Also, monitor for anomalous outbound traffic, as marketing tools often have liberal egress rules which attackers love for C2.

Here is a basic Sigma rule logic to catch potential exploitation attempts via unusual processes spawning from the ACC binary path:

detection:
  selection:
    ParentImage|endswith: '\nlserver.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\bash'
  condition: selection

Marketing stacks are frequently the forgotten stepchild in vulnerability management compared to the OS or Exchange. How is your team handling patching for "business-critical" but "security-ignored" apps like this?