CVE-2026-48323: Adobe Campaign Classic template engine RCE
TL;DR - CVE-2026-48323 is a critical Adobe Campaign Classic RCE tied to template engine neutralization failures. - Adobe Campaign Classic users should review APSB26-120 immediately and identify all exposed ACC instances. - No confirmed in-the-wild exploitation is available from current primary sources, but urgency is high due to CVSS 10.0.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-48323 |
| CVSS | 10.0 (Critical) |
| Attack vector | Not explicitly confirmed in retrieved primary-source vector string; NVD description is consistent with remote exploitation |
| Privileges required | Not explicitly confirmed in retrieved primary-source vector string |
| Patch available | Vendor advisory exists: Adobe APSB26-120. Specific fixed version could not be verified from retrieved primary content |
CVE-2026-48323 is a critical remote code execution issue in Adobe Campaign Classic (ACC). NVD describes the bug as an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. In practical terms, this points to attacker-controlled input being interpreted by a templating subsystem in a way that can cross the boundary from data into executable logic.
Defenders should note two important details from the NVD description: no user interaction is required, and scope is changed. Even without the full CVSS vector string available in the retrieved material, those characteristics strongly suggest this is not a low-friction bug that depends on phishing, local access, or complex social engineering. For enterprise environments running ACC, this should be treated as a high-priority server-side issue until Adobe’s exact version guidance is validated.
What Is This Vulnerability?
At the root-cause level, CVE-2026-48323 is classified under Improper Neutralization of Special Elements Used in a Template Engine. That class of bug is often associated with template injection, expression injection, or unsafe server-side rendering flows. The core failure is that untrusted input is not sufficiently constrained before it is passed into a template parser or rendering engine that supports executable expressions, directives, or macro-like constructs.
When that happens, an attacker may be able to supply crafted input that is treated as template logic instead of plain text. Depending on how the application uses templates, the result can range from data exposure to full command or code execution. In this case, NVD states the impact is arbitrary code execution in the context of the current user, which means successful exploitation could allow an attacker to run code with the permissions of the Adobe Campaign Classic service or process user handling the vulnerable operation.
For practitioners, the “template engine” detail matters because it usually means normal input validation at the HTTP layer is not enough. Even if requests look syntactically valid, payloads embedded in fields used by rendering, personalization, scripting, or content assembly pipelines may still trigger execution deeper in the application stack. In systems like ACC, which commonly handle campaign content, workflows, and message generation, that is a meaningful attack surface.
The mention of scope changed also deserves attention. In CVSS terms, that generally indicates a compromise in one component can impact resources beyond the original security authority of the vulnerable component. In plain English, a flaw in a templating path may enable access or execution effects broader than the immediate web request context, which is one reason the severity reaches the maximum score.
Who Is Affected?
The confirmed affected product from the retrieved primary-source material is Adobe Campaign Classic (ACC). That identification comes from the NVD record and Adobe’s referenced advisory, APSB26-120. If your organization runs Adobe Campaign Classic on-premises, in hosted form, or as part of a hybrid deployment model, you should assume the product line is in scope until you can verify the exact build guidance directly from Adobe.
The most important limitation in the currently retrieved data is this: the exact affected version ranges were not recoverable from primary content during this research run, and the fixed version number was also not recoverable with confidence because the Adobe bulletin page could not be fetched successfully. Because of that, it would be inaccurate to publish specific version ranges or build numbers here.
That uncertainty should shape your response, not delay it. In the absence of confirmed version detail, defenders should assume that any deployed Adobe Campaign Classic instance may be affected until validated against the vendor bulletin. This is especially important for internet-reachable ACC components, administrative interfaces, and application nodes that process templates, campaign content, workflows, or rendering tasks.
If you maintain an asset inventory, now is the time to identify every ACC deployment, including less-visible staging, DR, and legacy systems. A common operational mistake is patching only the obvious production node while leaving secondary instances unchanged. For a template-engine RCE, forgotten infrastructure can become the easiest path for attackers.
CVSS Score Breakdown
NVD currently assigns CVE-2026-48323 a CVSS v3.1 base score of 10.0, the maximum possible score. That alone places it in the highest urgency class, but security teams should understand what likely drives that rating rather than relying only on the number.
The NVD narrative explicitly states three high-impact characteristics: arbitrary code execution, no user interaction required, and scope changed. Together, those factors indicate a vulnerability that can plausibly be exploited without waiting for a user to click anything and can produce effects beyond a narrowly isolated component boundary. In a server product like Adobe Campaign Classic, that raises the potential blast radius considerably.
The retrieved tool output did not include the full vector string, so some score components, such as the formally encoded attack vector, privileges required, and confidentiality/integrity/availability impact values, cannot be quoted verbatim from primary-source data here. Defenders should avoid guessing the exact vector fields, even if the description strongly suggests a network-reachable RCE profile.
In practice, a 10.0 score tells you how to prioritize even before every vector element is independently verified. This is the class of issue that typically moves into emergency patch windows, temporary exposure reduction, heightened monitoring, and executive awareness. For regulated environments or organizations with public-facing marketing and communications infrastructure, it also warrants a review of segmentation and service account permissions in case exploitation guidance emerges quickly.
Exploitation Status
Based on the retrieved primary sources, there is no confirmed evidence at this time that CVE-2026-48323 is being actively exploited in the wild. A lookup against the CISA Known Exploited Vulnerabilities (KEV) catalog shows that this CVE is not currently listed. That means there is no CISA-backed confirmation, as of this writing, of active exploitation.
Likewise, no public proof-of-concept (PoC) was identified in the retrieved source set used for this article. That does not mean exploit development is unlikely. It only means the research inputs available here did not confirm a publicly accessible PoC, exploit module, or technical demonstration.
For defenders, the right interpretation is balanced: there is no confirmed in-the-wild exploitation, and there is no confirmed public PoC from the current evidence set, but the bug still deserves urgent treatment because of its severity and likely exploitation value. Attackers often reverse engineer patches or vendor fixes quickly, especially when the vulnerability class is conducive to reliable server-side exploitation.
If your patch process depends on KEV inclusion before action, this is a case where waiting would be risky. KEV is useful for prioritization, but a critical unauthenticated or low-friction server-side RCE in enterprise software should usually trigger immediate review regardless of KEV status.
How to Detect It
Detection is challenging here because the precise vulnerable code path and affected build details were not recoverable from the advisory during this run. That means defenders should focus on behavioral indicators around Adobe Campaign Classic rather than relying on a single known-bad IOC. Specifically, monitor for unusual requests to ACC web endpoints, unexpected rendering errors, child process creation from ACC services, and outbound connections from ACC servers that deviate from baseline behavior.
Because the flaw involves template engine neutralization, suspicious activity may appear as malformed or expression-heavy input delivered to endpoints involved in content rendering, workflow execution, personalization, or message preparation. You should also review application and web server logs for spikes in 500-level responses, parser failures, or exceptions that coincide with crafted request payloads. In many cases, failed exploit attempts are visible before successful ones.
Technical Notes
Start by pulling recent web and application logs from systems hosting Adobe Campaign Classic and fronting reverse proxies or WAFs. Look for requests containing expression syntax, templating delimiters, encoded metacharacters, or abnormally long values in parameters that feed content-generation workflows.
Example generic patterns to hunt for in HTTP logs:
(\{\{.*\}\}|\$\{.*\}|<%.*%>|%7B%7B|%24%7B|%3C%25)
Example Splunk search for suspicious templating payloads and server errors:
index=web OR index=app
(host="acc*" OR sourcetype="nginx:access" OR sourcetype="apache:access" OR sourcetype="tomcat")
("{{" OR "${" OR "<%" OR "%7B%7B" OR "%24%7B" OR "%3C%25" OR "template" OR "render")
| stats count min(_time) as firstSeen max(_time) as lastSeen by host, src_ip, uri_path, http_method, status, user_agent
| sort - count
Example Sigma-style logic concept for web logs:
title: Suspicious Template Injection Patterns Targeting Adobe Campaign Classic
status: experimental
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- "{{"
- "${"
- "<%"
- "%7B%7B"
- "%24%7B"
- "%3C%25"
condition: selection
level: high
Also monitor for process execution from ACC-related service accounts on Linux or Windows hosts. Even absent a confirmed exploit chain, code execution on a campaign server often manifests as shell invocation, interpreter launches, or network utilities appearing where they normally should not.
Example Linux process hunting:
ps -ef | egrep 'bash|sh|python|perl|curl|wget|nc'
Example EDR query concept: - Parent process: ACC application service, Java process, web server worker, or campaign runtime - Child process: shell, PowerShell, cmd.exe, curl, wget, certutil, python, perl - Network: unexpected egress from ACC nodes to unapproved destinations
If you do not have deep application logs, start with reverse proxy, WAF, EDR, and OS auditing. Those layers often provide enough signal to catch exploitation attempts against server-side RCEs before vendor-specific signatures are available.
Mitigation and Patching
The vendor advisory referenced by NVD is Adobe Security Bulletin APSB26-120:
At the time of writing, the existence of a vendor bulletin is confirmed, but the specific fixed version number and exact affected version ranges could not be verified from retrievable primary-source content. Because this article will not invent version data, the correct operational guidance is: review APSB26-120 directly and map your deployed ACC builds against Adobe’s published remediation guidance before closing the ticket.
Even without the exact fixed build number in hand, there are concrete steps administrators can take right now. First, identify every Adobe Campaign Classic node and determine which ones are internet-exposed. Second, restrict external access wherever possible, especially to administrative and application endpoints that are not required for public workflows. Third, increase monitoring and EDR scrutiny on those hosts until patch validation is complete.
If Adobe has published a patch or updated package through its normal distribution channel, apply that exact vendor-recommended update rather than making unsupported file-level changes. If your environment is hosted or managed by a third party, obtain written confirmation of the remediated build level and maintenance timeline.
Technical Notes
Because the exact fixed build could not be verified here, the upgrade command must be framed as a validation workflow rather than a guessed package string. Use the following process-oriented commands to inventory ACC systems and prepare patch deployment.
On Linux, identify installed Adobe Campaign components and package metadata:
rpm -qa | grep -i campaign
dpkg -l | grep -i campaign
systemctl list-units | grep -i campaign
ps -ef | grep -i campaign
Capture the host’s current version and installed files before maintenance:
mkdir -p /var/tmp/acc-cve-2026-48323
rpm -qa > /var/tmp/acc-cve-2026-48323/rpm-packages.txt 2>/dev/null
dpkg -l > /var/tmp/acc-cve-2026-48323/dpkg-packages.txt 2>/dev/null
systemctl status '*/campaign*' > /var/tmp/acc-cve-2026-48323/services.txt 2>&1
If your deployment uses a repository-managed package supplied by Adobe or an approved platform maintainer, the actual upgrade step will typically follow your package manager workflow after you confirm the fixed build from APSB26-120:
# RHEL/CentOS-like
sudo dnf upgrade <verified-adobe-campaign-package>
# Debian/Ubuntu-like
sudo apt update
sudo apt install --only-upgrade <verified-adobe-campaign-package>
Do not substitute guessed package names. Replace <verified-adobe-campaign-package> only after confirming the exact package and fixed version from Adobe’s advisory or support channel.
If patching is temporarily delayed, implement compensating controls: 1. Remove or limit internet exposure to ACC where feasible. 2. Restrict source IPs to management and application interfaces. 3. Enforce allowlisted egress from ACC servers. 4. Increase WAF inspection for template-like payload syntax. 5. Monitor child process execution and outbound connections from ACC service accounts.
On a reverse proxy or WAF, a temporary block rule can target common template injection metacharacters in suspicious requests, understanding that this is only a stopgap and may require tuning to avoid false positives.
Example ModSecurity-style concept:
SecRule ARGS|REQUEST_URI|REQUEST_BODY "@rx (\{\{.*\}\}|\$\{.*\}|<%.*%>)" \
"id:4832301,phase:2,deny,status:403,log,msg:'Possible template injection attempt targeting ACC'"
That workaround is not a substitute for patching. It may reduce opportunistic probing, but a determined attacker may bypass simple signature checks.
References
The primary source for vulnerability metadata is the NVD record for CVE-2026-48323, which describes the issue as an improper neutralization flaw in a template engine that can lead to arbitrary code execution in the context of the current user. NVD also notes that exploitation requires no user interaction and that scope is changed, supporting the severity assessment.
The second key source is CISA KEV status, which currently does not list this CVE. That absence should be interpreted carefully: it means there is no current CISA confirmation of in-the-wild exploitation, not that exploitation is impossible or unlikely. The Adobe vendor bulletin remains the authoritative source for exact affected and fixed versions.
For further reading, you can check out our articles on spear phishing and the best antivirus for freelancers in 2026.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.