CVE-2026-48303 is an Incorrect Authorization vulnerability in Adobe Campaign Classic (ACC) affecting versions 7.4.3 build 9394 and earlier. This vulnerability allows an attacker to execute arbitrary code with the privileges of the current user without any user interaction. The scope of the vulnerability is changed, indicating that the impact extends beyond the initially intended security boundaries. The CVSS 3.1 base score is 10.0, reflecting critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability can be exploited remotely without user interaction, increasing the risk of widespread impact. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Adobe Campaign Classic instances and monitor for suspicious activity related to unauthorized code execution attempts.