Adobe Campaign Classic Hit by Three Critical Unauthenticated RCE Flaws

Overview/Introduction

On August 3 2026 Adobe published security bulletin APSB26-120, announcing a wave of critical flaws in Adobe Campaign Classic (ACC) 7.4.3 (build 9398) and earlier. The most dangerous of these are three unauthenticated remote code execution (RCE) vulnerabilities that score a perfect CVSS 10.0. Because they require no credentials or user interaction, any ACC instance exposed to the internet-or even to a loosely-trusted internal network-can be fully compromised.

ACC is a cornerstone marketing-automation platform for enterprises, handling customer profiles, email orchestration, and cross-channel campaign logic. A breach therefore endangers not only the marketing data but also any downstream services that ACC integrates with (e.g., CRM, data-warehouses, analytics pipelines).

Technical Details

The three CVEs share a common theme: improper input sanitisation in server-side components that process HTTP requests, template rendering, and SQL statements.

• CVE-2026-48331 - Server-Side Request Forgery (SSRF)
  CWE-918. The vulnerable endpoint accepts a URL parameter that is later fetched by the server without adequate validation. An attacker can force the server to issue HTTP/HTTPS requests to internal services, cloud metadata endpoints (e.g., http://169.254.169.254), or any reachable host. Chaining the SSRF with an internal admin console or a mis-configured service can lead to credential disclosure and, eventually, arbitrary code execution.
• CVE-2026-48323 - Template Engine Injection
  CWE-1336. ACC’s custom template engine evaluates user-controlled expressions embedded in campaign-rendered HTML. The flaw allows injection of arbitrary template directives (e.g., ${{runtime.exec('cmd')}}}) that are executed with the privileges of the ACC process. Because the template engine is invoked during normal campaign rendering, an attacker can trigger the payload simply by submitting a crafted campaign object via the public API.
• CVE-2026-48330 - SQL Injection
  CWE-89. A poorly-parameterised SQL query in the “Audience Segmentation” module concatenates raw input into the WHERE clause. An unauthenticated attacker can craft a request that injects UNION SELECT … or EXEC xp_cmdshell payloads, leading directly to remote code execution on the database host. The vulnerability is exploitable over the network without any prior authentication.

Additional high-severity bugs fixed in the same release include:

• CVE-2026-48326 - SQL injection (CVSS 9.9) - requires low-privilege credentials.
• CVE-2026-48333 - Incorrect authorization (CVSS 9.8) - enables privilege escalation.
• CVE-2026-48317 - Eval injection (CVSS 9.6) - similar to the template engine flaw but limited to certain admin scripts.
• CVE-2026-48399 - Security-feature bypass (CVSS 7.5) - weakens CSP/Content-Security-Policy enforcement.

Impact Analysis

All three CVSS 10.0 flaws are classified as Remote, Network-accessible, Unauthenticated, No Interaction Required. The attack surface includes any ACC instance that:

• exposes its HTTP API or web console to the public internet, or
• is reachable from a compromised internal host (e.g., via lateral movement).

Successful exploitation yields full system compromise**: the attacker runs code as the ACC service account (often root on Linux or Administrator on Windows), can read/write campaign data, extract customer PII, and pivot to connected back-end systems. Because ACC frequently stores API keys for downstream services, attackers can also harvest credentials for Salesforce, SAP, or other enterprise platforms.

Timeline of Events

• July 28 2026 - Adobe’s internal security team discovers the SSRF and template-engine bugs during a routine code audit.
• July 31 2026 - Coordinated disclosure begins with private advisory sent to affected customers.
• August 2 2026 - Additional SQL injection (CVE-2026-48330) identified; advisory updated.
• August 3 2026 - Public release of APSB26-120, patches bundled in ACC 7.4.3 build 9399, and advisory posted on Adobe Security Bulletins.
• August 4 2026 - Media coverage ramps up; security blogs publish technical analyses.
• August 5 2026 - This article published on RootShell.blog.

Mitigation/Recommendations

1. Patch immediately. Upgrade all ACC deployments to v7.4.3 build 9399 or later. The patch addresses all seven CVEs listed above.
2. Network segmentation. If immediate patching is not possible, block external access to the ACC web UI and API endpoints (port 80/443). Restrict inbound traffic to trusted internal subnets only.
3. Validate inbound requests. Deploy a web-application firewall (WAF) that denies SSRF-style URL parameters (e.g., disallow requests to 169.254.169.254 or private IP ranges).
4. Least-privilege execution. Run ACC under a non-root, non-administrative service account and enforce OS-level sandboxing (e.g., SELinux/AppArmor profiles).
5. Monitor for indicators of compromise. Look for anomalous outbound connections from the ACC host, unexpected database queries containing xp_cmdshell, or new scheduled tasks created by the ACC service account.
6. Review template usage. Audit all stored templates for suspicious expression syntax. Disable dynamic evaluation features if they are not required.
7. Credential rotation. After patching, rotate any API keys or database credentials stored in ACC configuration files.

Real-World Impact

Enterprises that rely on ACC for large-scale email and SMS campaigns often integrate it with customer-data platforms (CDPs), analytics pipelines, and loyalty-program back-ends. A breach could therefore:

• Expose millions of customer email addresses, phone numbers, and behavioural profiles, violating GDPR, CCPA, and other privacy regulations.
• Allow attackers to send phishing or malicious marketing messages from a trusted brand domain, eroding brand reputation and increasing the risk of downstream attacks on recipients.
• Provide a foothold for ransomware operators to encrypt not only the ACC host but also attached data warehouses, leading to costly downtime.
• Facilitate supply-chain compromise: stolen API keys can be used to infiltrate downstream SaaS services, extending the attack surface far beyond the original ACC server.

Given the high value of marketing data and the automated nature of campaign dispatch, even a brief window of compromise can result in mass-scale abuse before detection.

Expert Opinion

From a strategic standpoint, these ACC flaws underscore a broader industry trend: marketing-automation platforms are becoming high-value, low-visibility targets. Historically, attackers focused on traditional web-applications or credential-heavy services (e.g., Exchange, SharePoint). However, the convergence of rich data, integrated APIs, and powerful server-side scripting engines creates a perfect storm for remote code execution.

Adobe’s decision to assign a Priority 1 rating and a CVSS 10.0 score to three separate bugs is a clear signal that the vendor now recognises the systemic risk posed by these platforms. For defenders, the key take-aways are:

1. Never treat marketing tools as “low-risk” back-office systems; they often run with elevated privileges and have direct access to PII.
2. Implement defence-in-depth: patch management, network isolation, and runtime monitoring must all be part of the security baseline.
3. Regularly audit third-party SaaS integrations for insecure template or query handling - many of the same patterns that caused the ACC bugs appear in other automation products.

In the coming months we can expect threat actors to weaponise the publicly disclosed exploitation techniques, especially against organisations that missed the patch window. Proactive remediation, coupled with continuous monitoring, is the only realistic path to mitigate the fallout from these critical vulnerabilities.