CVE-2026-48303: Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

Synopsis

An incorrect authorization vulnerability in Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier allows a remote, unauthenticated attacker to bypass access controls entirely. The vulnerability is reachable over the network with no credentials or user interaction required, and its scope extends beyond the directly affected component. Successful exploitation results in arbitrary code execution in the context of the current user, giving the attacker full read, write, and availability impact across affected systems. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the ACC service over the network; no local or physical access is needed, making any internet- or intranet-exposed ACC instance a viable target.

• AuthenticationNot required

  No credentials of any privilege level are required; the authorization bypass can be triggered by an anonymous request.

• Victim interactionNot required

  The exploit completes without any action from a logged-in user or administrator.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions, memory-layout dependencies, or other environmental factors standing between the attacker and successful exploitation.

Blast Radius

• The attacker executes arbitrary code in the context of the ACC service user, gaining a foothold on the host running the application.
• All data stored or accessible by ACC, including campaign records, contact lists, and stored credentials, is readable by the attacker.
• The attacker can modify or delete campaign configurations, scheduled jobs, delivery templates, and persisted database rows reachable by the ACC service account.
• The attacker can crash or render the ACC service unavailable, disrupting marketing delivery pipelines and dependent downstream integrations.