Critical Pre-Authentication RCE Vulnerability in Adobe Campaign Classic: Exploit Analysis and Mitigation Strategies

Overview

Adobe Campaign Classic (ACC) is vulnerable to a server-side template injection flaw (CVE-2026-48323) with a CVSS 10.0 score, enabling unauthenticated attackers to achieve remote code execution without user interaction. Immediate mitigation is required to prevent full server compromise.

Technical Analysis

The vulnerability stems from improper input sanitization in ACC's templating engine, allowing attackers to inject malicious code via HTTP requests to public endpoints (e.g., subscription forms, API handlers). Exploitation requires no authentication and leverages SSTI to execute arbitrary commands in the context of the ACC service account. The 'changed scope' aspect indicates lateral movement potential, escalating risk beyond initial attack vectors.

Enterprise & DIB Impact

DIB and enterprise environments utilizing ACC for marketing automation face severe exposure, as attackers could exfiltrate sensitive data, disrupt operations, or pivot to internal networks. Given ACC's common deployment in customer engagement workflows, exploitation could compromise both external and internal infrastructure assets.

Recommended Actions

• Apply Adobe's official security patch immediately
• disable unnecessary public-facing ACC endpoints until patched
• implement strict input validation for all template-rendering interfaces
• monitor server logs for SSTI-based payload patterns
• and conduct incident response drills assuming active exploitation