Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction

Summary

Adobe released updates for Campaign Classic addressing a CVSS 10.0 flaw enabling arbitrary code execution. Updates also fix an SQL injection flaw. Adobe Bridge received fixes for eight critical vulnerabilities, including privilege escalation and code execution.

Key Takeaways

1. Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution.
2. The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system.
3. Users are advised to apply the latest updates for optimal protection.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 15% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents factual information about security vulnerabilities and software updates. It cites specific CVE numbers and CVSS scores, lending it a high degree of technical credibility. The information is presented objectively without overt sensationalism.

Bias assessment: Technical Reporting. The article focuses on technical details of software vulnerabilities and their fixes. It uses industry-standard scoring systems (CVSS) and specific identifiers (CVEs) to convey information. The language is neutral and informative, aiming to alert users to security issues.

Note: This article details critical security vulnerabilities. Users of Adobe Campaign Classic and Adobe Bridge should apply the latest updates immediately for protection.

Credibility flag: Technical Security Alert

Claimed Facts (7)

• This is a direct statement of fact regarding Adobe's actions and the nature of the flaw.
• This provides a specific, verifiable identifier (CVE) and a standardized score (CVSS) for the vulnerability.
• This describes the technical mechanism of the vulnerability, presented as a factual explanation.
• This states the resolution of a second, specific vulnerability with its identifier and score.
• This provides specific version information for the software update, a factual detail.
• This factually reports on additional security updates for a different Adobe product.
• This attributes the discovery of specific vulnerabilities to named individuals, a factual reporting of credit.

Opinions (2)

• While presented as a quote from an advisory, the characterization of vulnerabilities as 'critical' and the potential outcomes are Adobe's assessment and framing.
• The term 'optimal protection' is a subjective assessment of the benefit of applying the updates.

Claims (5)

• While CVSS scores are standardized, the future date (2026) for a reported vulnerability and its fix suggests this is a hypothetical or illustrative example rather than a current event, making its factual basis questionable in a real-time context.
• Similar to the above, the future date of the CVE makes this claim dubious in terms of current relevance.
• The future date of the CVE makes the claim of this vulnerability being a current issue dubious.
• The future dates associated with these CVEs cast doubt on the current applicability and factual basis of these attributions.
• While this is a common statement in security advisories, the future date of the CVEs makes the claim about current exploitation status dubious.

Key Sources

• Adobe — Software Company
• Ravie Lakshmanan — Author
• The Hacker News — Cybersecurity News Outlet
• Kieran — Security Researcher
• yjdfy — Security Researcher