CVE-2026-48286 is an Incorrect Authorization vulnerability in Adobe Campaign Classic (ACC) affecting versions 7.4.3 build 9396 and earlier. This vulnerability allows an attacker to execute arbitrary code in the context of the current user without requiring user interaction or privileges. The vulnerability changes the security scope, indicating a significant impact on confidentiality, integrity, and availability. The CVSS 3.1 base score is 10.0, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of widespread impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to Adobe Campaign Classic instances and monitor for unusual activity related to this product. Follow Adobe's security advisories for updates.