CVE-2026-48286: Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

Synopsis

An incorrect authorization vulnerability in Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier allows a remote, unauthenticated attacker to bypass access controls and execute arbitrary code in the context of the running service. The vulnerability is reachable over the network with no credentials and no victim interaction required, and the changed scope indicator means a successful attacker can affect resources beyond the immediate application boundary. Exploitation achieves full confidentiality, integrity, and availability impact, including arbitrary code execution. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ACC service over the network; no prior foothold on the host is required.

• AuthenticationNot required

  No credentials of any privilege level are needed to trigger the vulnerability.

• Victim interactionNot required

  The exploit completes without any action from a logged-in user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory-layout assumptions, or special environmental factors need to align.

Blast Radius

• A successful attacker executes arbitrary code in the context of the ACC service process, gaining a direct execution foothold on the host.
• Full confidentiality loss means the attacker reads any data the service can access, including campaign recipient records, credentials stored in the application, and connected database contents.
• Full integrity loss means the attacker modifies or deletes campaign data, configuration, and any files the service account can write.
• Full availability loss means the attacker crashes or locks the ACC service, disrupting email delivery and campaign scheduling for the affected installation; the changed scope means adjacent systems sharing infrastructure can also be affected.