Adobe Patches CVSS 10.0 Campaign Classic Flaw and Eight Critical Bridge Vulnerabilities
Summary
Adobe patched CVE-2026-48449, a CVSS 10.0 Campaign Classic flaw that could enable code execution without user interaction, plus another Campaign Classic flaw and eight critical Bridge vulnerabilities. Adobe reports no known active exploitation.
Key points
- CVE-2026-48449 is a CVSS 10.0 incorrect-authorization flaw in Adobe Campaign Classic that could allow arbitrary code execution as the current user without user interaction.
- CVE-2026-48448 is a high-severity SQL injection flaw that could enable arbitrary file reads.
- Adobe fixed both Campaign Classic vulnerabilities in ACC v7 version 7.4.3 build 9398 for Windows and Linux.
- Adobe also addressed eight critical-rated Adobe Bridge vulnerabilities involving code execution and privilege escalation, including untrusted search path, incorrect authorization, path traversal, and out-of-bounds write flaws.
- Adobe said it is not aware of exploitation of the vulnerabilities and recommends installing the latest updates.
Article Details
- Vulnerability Types
- Incorrect authorization
- SQL injection
- Untrusted search path
- Path traversal
- Out-of-bounds write
- Severity
- Critical; CVE-2026-48449 is rated CVSS 10.0, CVE-2026-48448 is rated 8.6, and the Adobe Bridge flaws are rated 7.8–8.6.
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-48374Adobe · BridgeCVE-2026-48374 (CVSS score: 7.8) – A path traversal vulnerability that leads to arbitrary code executionCVE-2026-48390Adobe · BridgeCVE-2026-48390 (CVSS score: 8.6) – An incorrect authorization vulnerability that leads to privilege escalationCVE-2026-48391Adobe · BridgeCVE-2026-48391 (CVSS score: 8.2) – An untrusted search path vulnerability that leads to arbitrary code executionCVE-2026-48392Adobe · BridgeCVE-2026-48392 (CVSS score: 7.8) – An out-of-bounds write vulnerability that leads to arbitrary code executionCVE-2026-48393Adobe · BridgeCVE-2026-48393 (CVSS score: 7.8) – An out-of-bounds write vulnerability that leads to arbitrary code executionCVE-2026-48394Adobe · BridgeCVE-2026-48394 (CVSS score: 7.8) – An out-of-bounds write vulnerability that leads to arbitrary code executionCVE-2026-48395Adobe · BridgeCVE-2026-48395 (CVSS score: 8.6) – An untrusted search path vulnerability that leads to arbitrary code executionCVE-2026-48396Adobe · BridgeCVE-2026-48396 (CVSS score: 8.6) – An incorrect authorization vulnerability that leads to arbitrary code executionCVE-2026-48448Adobe · Campaign#AdobeCVE-2026-48449Adobe · Campaign#Adobe
People
Vendors
Products
Adobe BridgeAdobe has released critical security updates for Campaign Classic and Adobe Bridge to fix flaws that could lead to arbitrary code execution, privilege escalation, and file reads.Adobe Campaign ClassicAdobe has released critical security updates for Campaign Classic and Adobe Bridge to fix flaws that could lead to arbitrary code execution, privilege escalation, and file reads.