CVE-2026-48286

Think of ACC like a company software “front desk” that should only let the right people do the right actions. This flaw is about the front desk failing to properly check whether someone should be allowed in.

If an attacker can reach the system in the right way, they may be able to run code using the permissions of the current user—like getting the software to do harmful things while pretending to be allowed.

This matters if your business runs or hosts Adobe Campaign Classic (ACC), especially if your installed version is 7.4.3 build 9396 or earlier.

The risk is mainly about reachability and exposure: it becomes a concern when an attacker can reach the vulnerable ACC service (for example, from outside your trusted network).

This is an AMBER issue: it’s serious because it can lead to arbitrary code execution, and the affected scope is clearly defined (ACC 7.4.3 build 9396 and earlier).

However, there’s no KEV listing and no clear dated public exploitation claim reported, so treat it as a priority patching item rather than an “already everywhere” emergency.