CVE-2026-48326 is an SQL Injection vulnerability in Adobe Campaign Classic caused by improper neutralization of special elements in SQL commands (CWE-89). This flaw enables a low-privileged attacker to execute arbitrary code in the context of the current user without requiring user interaction. The vulnerability changes the security scope and has a CVSS 3.1 base score of 9.9, indicating critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with low privileges to execute arbitrary code remotely, potentially leading to full system compromise including data disclosure, modification, and service disruption. The vulnerability affects the security scope, increasing the potential impact beyond the immediate user context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Adobe Campaign Classic instances and monitor for suspicious activity related to SQL injection attempts.