Adobe has fixed vulnerabilities in Adobe Campaign Classic. The NCSC (advisory NCSC-2026-0273) points to a combination of serious problems in the core authorization mechanism and an SQL injection that enables an attacker to perform unauthorized actions.
The likelihood of misuse is assessed as medium, but the potential damage is high. This makes fast follow-up especially important for organizations that run Campaign Classic fully on-premises or use a hybrid setup.
What exactly was patched in Adobe Campaign Classic?
According to the NCSC advisory, there are two vulnerabilities with a severe impact. First, there is a flaw in authorization within the core authorization mechanisms of Campaign Classic. This flaw allows an attacker to execute arbitrary code without requiring any user interaction.
With that, an attacker can carry out actions outside the intended permissions. In concrete terms, the attacker can not only misuse data, but also attempt to influence the system at will.
The second vulnerability is SQL injection. Because of this flaw, an attacker can run unauthorized queries, read files from the system, and access sensitive memory information. Here too, misuse is possible without any action required from a user.
Which CVEs and impact are included?
The NCSC advisory mentions two CVEs: CVE-2026-48449 and CVE-2026-48448. The highest base CVSS score in the advisory is 10.0, indicating a very serious threat.
The categories are linked in the source to CWE-89 (SQL injection) and CWE-863 (incorrect authorization), respectively. Together, they define the risks: bypassing access rules, executing unwanted code, and exfiltrating sensitive information.
Cloud vs. on-premises: why your environment matters
Adobe indicates that the vulnerabilities have already been fixed in the cloud version of Campaign Classic. That means organizations that use only the cloud configuration are typically already covered.
The information from the NCSC advisory is especially relevant for organizations that:
- run Campaign Classic fully on-premises, or
- work with a hybrid solution where on-premises components still exist.
In those scenarios, you should not assume that “Adobe has it handled” automatically means your installation is covered as well. You need to verify whether your deployment includes the patched components.
What you can do now: practical action steps
Because the damage is assessed as high and misuse does not depend on user interaction, this is something for both your regular patch cycle and a faster assessment within your change process.
1) Inventory your Adobe Campaign Classic environment
First, map where Campaign Classic is running: which servers, which versions, and how the integration is set up. Pay extra attention to environments with on-premises components or hybrid connections.
2) Check whether you already have the updates Adobe released
Adobe has released updates to fix the vulnerabilities in Adobe Campaign Classic. Compare your current version with the information Adobe publishes, and plan an immediate upgrade if you are not yet on the right level.
3) Limit impact during the rollout window
As long as the patch has not been implemented, the risk remains. Consider temporary measures that reduce the attack surface (for example, segmentation, additional access restrictions, and monitoring for suspicious requests) to lower the chance of misuse.
4) Monitor for signs of misuse
Because the issues affect both authorization and database behavior, there may be indicators such as unusual database queries or abnormal behavior around campaigns and authorizations. Configure logging and detection so you can quickly spot deviations.
Why this topic fits within supply chain security
While this advisory directly concerns a product vulnerability, it also relates to Software Supply Chain Security: your building blocks and application platforms strongly determine how attackers can reach your data and systems. When a platform like Campaign Classic is vulnerable, it can affect processes related to communication, automation, and data exchange.
In marketing and campaign stacks, a lot of business logic is often involved: permissions, templates, tracking, data connections, and databases. That’s why “just patch later” is risky—especially when misuse is possible without user interaction.
Related security items to take along
Many organizations also see that misuse often revolves around the same underlying principles: authorization that doesn’t work correctly, input that isn’t validated well enough, and then an escalation to a larger impact. If you look more broadly at recent incidents and patches, these insights help you sharpen your priorities.
- Read also: VMware fixes: critical auth bypass and VM-escapes — similar in terms of the impact of failing access mechanisms.
- Also see: Compromised npm and Python packages: action steps — useful when you’re assessing how dependencies and code chains can contribute to risk.
Conclusion: patch quickly, especially for on-premises
The NCSC advisory makes clear that Adobe Campaign Classic contained vulnerabilities that could lead to arbitrary code execution through incorrect authorization and to SQL injection enabling data access and access to sensitive information. The cloud version has now been addressed, but on-premises and hybrid environments require immediate action.
Are you still using an on-premises configuration? Then plan the Adobe updates as soon as possible, check your current status, and strengthen monitoring for suspicious activity. That way, you reduce the risk before an attacker gets room to operate.
Source: https://advisories.ncsc.nl/csaf/v2/2026/ncsc-2026-0273.json