CVE-2026-48381 is an SQL Injection vulnerability in Adobe Campaign Classic caused by improper neutralization of special elements in SQL commands. This flaw enables an attacker to execute arbitrary code with the privileges of the current user. Exploitation does not require user interaction but depends on conditions outside the attacker's control. The vulnerability changes the security scope and has a CVSS 3.1 base score of 9.0, indicating critical severity. No vendor advisory or patch information is currently available to confirm remediation status.

Successful exploitation can lead to arbitrary code execution, resulting in full compromise of the affected system's confidentiality, integrity, and availability. The attack does not require user interaction and can change the security scope, potentially allowing an attacker to escalate privileges or perform unauthorized actions within Adobe Campaign Classic.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor Adobe's security advisories and consider applying compensating controls specific to SQL injection mitigation if feasible.