The Hacker News32%
Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction 27%
By Ravie Lakshmanan18%
8/1/2026, 12:12:00 AM
BS Summary: This article contains 20 faulty reasoning types, including Representativeness Heuristic, Framing Effect, and Ambiguity (Equivocation), with Negativity Bias as the most egregious example at 17.8% saturation with 61 hits. Analysis detected 488 faulty-reasoning hits from 342 analyzed words, generating a BS Score of 33.8% and a BS Rank of 27% (18,521 of 25,189 articles). This article is better (less manipulative) than 73.50% of the article peer group.
Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution.
The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system.
It has been described as a case of incorrect authorization that could result in arbitrary code execution in the context of the current user without requiring any user interaction.
The update also resolves another high-severity flaw (CVE-2026-48448, CVSS score: 8.6) stemming from SQL injection that could pave the way for arbitrary file reads.
"This update addresses critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read," Adobe said in an advisory.
The company noted that it's not aware of any of the flaws being exploited in the wild.
Both shortcomings have been addressed in ACC v7: 7.4.3 build 9398 for Windows and Linux.
Separately, Adobe has also shipped updates to remediate eight critical-rated flaws in Adobe Bridge that could lead to privilege escalation and arbitrary code execution -
CVE-2026-48395 (CVSS score: 8.6) - An untrusted search path vulnerability that leads to arbitrary code execution
CVE-2026-48396 (CVSS score: 8.6) - An incorrect authorization vulnerability that leads to arbitrary code execution
CVE-2026-48390 (CVSS score: 8.6) - An incorrect authorization vulnerability that leads to privilege escalation
CVE-2026-48391 (CVSS score: 8.2) - An untrusted search path vulnerability that leads to arbitrary code execution
CVE-2026-48374 (CVSS score: 7.8) - A path traversal vulnerability that leads to arbitrary code execution
CVE-2026-48392 (CVSS score: 7.8) - An out-of-bounds write vulnerability that leads to arbitrary code execution
CVE-2026-48393 (CVSS score: 7.8) - An out-of-bounds write vulnerability that leads to arbitrary code execution
CVE-2026-48394 (CVSS score: 7.8) - An out-of-bounds write vulnerability that leads to arbitrary code execution
Adobe credited security researcher Kieran ("kaiksi") with discovering and reporting CVE-2026-48390, CVE-2026-48391, CVE-2026-48395, CVE-2026-48396, and CVE-2026-48374, and "yjdfy" for CVE-2026-48392, CVE-2026-48393, and CVE-2026-48394.
Users are advised to apply the latest updates for optimal protection.
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.