CVE-2026-48448

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to gain file system read access. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/campaign/apsb26-114.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:adobe:campaign:::::classic:::*
	cpe:2.3:a:adobe:campaign:7.4.3:9394:::classic:::*
	cpe:2.3:a:adobe:campaign:7.4.3:9396:::classic:::*
	cpe:2.3:a:adobe:campaign:7.4.3:9397:::classic:::*
	cpe:2.3:a:adobe:campaign:7.4.3:9398:::classic:::*

OR	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Adobe Campaign Classic (ACC) está afectado por una vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando SQL (’inyección SQL’) que podría conducir a la divulgación de memoria sensible. Un atacante podría aprovechar esta vulnerabilidad para obtener acceso de lectura al sistema de archivos. La explotación de este problema no requiere interacción del usuario. El alcance ha cambiado.

Information

Published : 2026-07-30 03:16

Updated : 2026-10-23 22:10

NVD link : CVE-2026-48448

Mitre link : CVE-2026-48448

CVE.ORG link : CVE-2026-48448

JSON object : View

Products Affected

linux

linux_kernel

adobe

campaign

microsoft

windows

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-48448", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48448", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T17:35:14.939309Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Adobe Campaign Classic", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "7.4.3 build 9397"}, {"status": "unaffected", "version": "7.4.3 build 9398", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T03:16:24.810", "references": [{"url": "https://helpx.adobe.com/security/products/campaign/apsb26-114.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to gain file system read access. Exploitation of this issue does not require user interaction. Scope is changed."}, {"lang": "es", "value": "Adobe Campaign Classic (ACC) est\u00e1 afectado por una vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando SQL (\u2019inyecci\u00f3n SQL\u2019) que podr\u00eda conducir a la divulgaci\u00f3n de memoria sensible. Un atacante podr\u00eda aprovechar esta vulnerabilidad para obtener acceso de lectura al sistema de archivos. La explotaci\u00f3n de este problema no requiere interacci\u00f3n del usuario. El alcance ha cambiado."}], "lastModified": "2026-10-23T22:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "7B8DCC6A-0967-4897-94B8-DD22DA5AB841", "versionEndIncluding": "7.4.2"}, {"criteria": "cpe:2.3:a:adobe:campaign:7.4.3:9394:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "A6BFE9C0-BB34-4769-B94E-14E637695679"}, {"criteria": "cpe:2.3:a:adobe:campaign:7.4.3:9396:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "E05FE070-A1F8-48B9-A15E-CB87E351E9E0"}, {"criteria": "cpe:2.3:a:adobe:campaign:7.4.3:9397:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "1BA9BB73-939F-4A0B-B8F5-1942E17F2265"}, {"criteria": "cpe:2.3:a:adobe:campaign:7.4.3:9398:*:*:classic:*:*:*", "vulnerable": true, "matchCriteriaId": "7ADE87F6-3CA4-4E35-A125-23C2FB605A95"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@adobe.com"}