Critical Vulnerabilities Disclosed in Adobe Campaign Classic Require Immediate Patching
Adobe has disclosed two serious vulnerabilities in Adobe Campaign Classic (ACC) that require urgent remediation. The company published its security advisory on 29 July 2026, highlighting risks to on-premises installations running on Windows and Linux.
The first issue, tracked as CVE-2026-48449, stems from improper authorization handling. It allows remote attackers to execute arbitrary code without requiring authentication and received the maximum CVSSv3.1 base score of 10.0.
The second vulnerability, CVE-2026-48448, is a SQL injection flaw. Unauthenticated attackers can leverage it to read arbitrary files stored on the file system, earning a CVSSv3.1 score of 8.6.
Adobe Campaign Classic is a campaign management product used by organizations to support marketing initiatives. Security researchers assess both flaws as carrying a high risk of future exploitation.
Administrators are strongly advised to apply the patches released by Adobe immediately to protect affected on-premises environments.
Related articles
Secure Error Logging Practices to Prevent Information Leaks Across Java, Kotlin, JavaScript and Python
The article examines how improper error logging can expose sensitive details such as stack traces, file paths, library versions and database structures, enabling attackers to map applications and craft targeted exploits. It covers core logging levels from DEBUG to FATAL, mechanisms including text files, binary logs and databases, plus the roles of Trace ID and Correlation ID in tracing requests across microservices. Real-world vulnerable code examples in Flask and SQLite demonstrate direct exception output, manual traceback exposure and SQL error leakage that confirm technologies like Python 3.10 or SQLite usage. CWE categories including CWE-209, CWE-532, CWE-538 and CWE-1295 are referenced to classify risks of information disclosure through logs. Mitigation steps include stripping version headers in Nginx, sanitizing inputs with regular expressions, using OpenTelemetry for structured JSON logging and avoiding debug modes in production. The guidance stresses balancing detailed logs for incident response with protections against injection and reconnaissance.
Cisco Releases Hotfixes for Actively Exploited CVE-2026-20316 Zero-Day in Secure FMC Allowing Static Credential Access
A zero-day vulnerability tracked as CVE-2026-20316 is being actively exploited in Cisco Secure Firewall Management Center, enabling remote attackers to authenticate using hardcoded low-privilege credentials without prior authentication. The flaw carries a CVSS score of 5.3 but has been elevated to High severity by Cisco due to its potential for chaining with other vulnerabilities to achieve privilege escalation. Cisco has issued hotfixes across multiple versions including 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0 while urging administrators to inspect logs for the presence of /var/tmp/license.tmp as an indicator of compromise. The same indicator is also linked to the related critical authentication bypass CVE-2026-20079 that can lead to root access via script execution. Organizations are advised to restrict management interface exposure through ACLs, VPNs and dedicated admin networks, rotate credentials after suspected compromise, and review sudo executions and license-related commands. U.S. federal agencies have a remediation deadline of August 1, 2026 under the Known Exploited Vulnerabilities catalog.
Broadcom Patches Five Critical VMware Vulnerabilities Including CVSS 9.8 Authentication Bypass
Broadcom has released fixes for five vulnerabilities across multiple VMware products that could enable authentication bypass, remote code execution, and virtual machine escapes. The most severe issue, CVE-2026-59309 with a CVSS score of 9.8, resides in the VMware Directory Service component of vCenter and allows an attacker with network access to bypass authentication entirely. Successful compromise of vCenter grants control over hosts, virtual machines, networks, and storage, posing severe risks to enterprise environments. A second critical flaw, CVE-2026-47876, affects the VMXNET3 virtual adapter in ESX and permits an attacker with administrative privileges inside a guest VM to perform an out-of-bounds write and execute code on the hypervisor host. Additional patches address an unauthorized memory read in ESX, Workstation, and Fusion, along with insufficient logging that could conceal administrative actions. No workarounds exist, and administrators must apply the specified updates to vCenter, ESX, Cloud Foundation, Workstation, and Fusion.
Firefox JIT Vulnerability Exposes Tor Browser Users to Remote Code Execution
A high-severity flaw in Firefox's SpiderMonkey JavaScript engine allows remote code execution simply by visiting a malicious page, directly impacting Tor Browser users on unpatched versions. Registered as CVE-2026-10702, the vulnerability stems from incorrect memory handling in the JIT compiler that leaves a dangling reference to freed memory, enabling arbitrary read and write primitives. Researchers demonstrated successful exploitation that can compromise the browser's content rendering process and facilitate user deanonymization or OS-level attacks. The same issue served as the initial stage in the IonStack exploit chain against ARM64 Android devices, where it was chained with CVE-2026-43499 in the Linux kernel to achieve root privileges. Mozilla addressed the issue in Firefox 151.0.3, and the Tor Project rolled out corresponding fixes in Tor Browser 15.0.19, which also incorporates the latest Firefox ESR updates.