Adobe has issued an urgent security update for Adobe Campaign Classic (ACC), following the revelation of multiple critical vulnerabilities that could permit unauthenticated remote attackers to execute arbitrary code on vulnerable servers This article explores security update adobe. . This issue is tracked under bulletin APSB26-120 and affects versions 7.4.3 build 9398 or earlier of Adobe Campaign Classic running on Windows and Linux operating systems.
The update has been rated with a Priority 1, urging customers currently using affected on-premises deployments to upgrade immediately to build 9399. An SSRF vulnerability, labeled CWE-918, exists on the server-side request handling component, allowing an attacker to access internal resources or services that would otherwise be inaccessible externally.
Two additional critical vulnerabilities, classified as CVE-2026-48323 and CVE-2026-48330, arise from improper neutralization of special elements within template engines and SQL command contexts. These flaws enable remote, unauthenticated arbitrary code execution. This bulletin is applicable only to fully on-premises ACC installations and components in hybrid environments; Adobe-hosted instances have been remediated, requiring no customer intervention.
Administrators should prioritize monitoring externally accessible Campaign Classic servers, restricting unnecessary public exposure, reviewing application and web-server logs for suspicious requests, and investigating unexpected outbound connections that may indicate SSRF abuse. Implement ANY.RUN to cut SOC investigation blind spots and contain threats earlier, reducing response costs and minimizing business disruption.
