CVE-2026-48286

Think of ACC like a company software “front desk” that should only let the right people do the right actions. This flaw is about the front desk failing to properly check whether someone should be allowed in.

If an attacker can reach the system in the right way, they may be able to run code using the permissions of the current user—like getting the software to do harmful things while pretending to be allowed.

This matters if your business runs or hosts Adobe Campaign Classic (ACC), especially if your installed version is 7.4.3 build 9396 or earlier.

The risk is mainly about reachability and exposure: it becomes a concern when an attacker can reach the vulnerable ACC service (for example, from outside your trusted network).

This is an AMBER issue: it’s serious because it can lead to arbitrary code execution, and the affected scope is clearly defined (ACC 7.4.3 build 9396 and earlier).

However, there’s no KEV listing and no clear dated public exploitation claim reported, so treat it as a priority patching item rather than an “already everywhere” emergency.

1) Confirm exposure

• Identify the Adobe Campaign Classic (ACC) version and build number you are running.
• Exposure per the report applies to ACC 7.4.3 build 9396 and earlier.

2) Get the correct fixed release

• Open Adobe’s advisory APSB26-69 and find the fixed ACC version/build(s) it specifies.
• Plan an upgrade to the first fixed release listed in that advisory (apply it to the ACC environment(s) your business uses).

3) Patch/upgrade plan

• Schedule the upgrade during an appropriate maintenance window.
• Validate after upgrade that ACC services start correctly and your normal campaign/operations workflows still work.

4) If you cannot patch right away (temporary containment)

• Ensure ACC is not reachable from the public internet.
• Restrict inbound access to only trusted networks/hosts (for example, specific office/VPN IP ranges or internal application gateways).
• Add/confirm firewall or reverse-proxy rules so only required ports and sources can connect.

5) What to monitor after changes

• Monitor ACC logs and your web/app gateway logs for unusual request patterns or repeated unauthorized access attempts.
• Keep an eye on Adobe security updates for follow-on guidance tied to this advisory.

KEV / exploitation context

• This CVE is not listed in CISA KEV based on the provided findings.
• Press reporting does not include a clear, dated exploitation claim in the provided findings, and no public exploit code is on record.

Summary

• Vulnerability: Incorrect Authorization (CWE-863) in Adobe Campaign Classic (ACC).
• Affected versions: 7.4.3 build 9396 and earlier.
• Impact (per findings/backstop): can enable arbitrary code execution in the context of the current user; exploitation does not require user interaction.

Exploit status and maturity

• No KEV listing in the provided findings.
• Press mentions exist but no clear, dated exploitation claim is provided in the findings.
• No public exploit code is on record.

Likelihood signals

• EPSS is provided as a prediction (do not treat as confirmed exploitation). The traffic-light decision is AMBER.

Mechanism (how it’s triggered)

• The weakness is authorization logic failing to properly restrict actions, allowing an attacker to perform operations they should not be permitted to perform; in this case, that failure can be leveraged to execute code with current-user privileges.

What “scope is changed” indicates

• The security impact crosses into a broader privilege boundary than a simple local flaw, consistent with the reported shift in execution context.