Adobe Releases Emergency Update for Campaign Classic Fixing Multiple Critical Vulnerabilities
Adobe has released an emergency security update for Adobe Campaign Classic to address seven critical vulnerabilities, several of which received the maximum CVSSv3.1 base score of 10.0.
The company disclosed the issues on August 3, 2026, through a security advisory and urged immediate application of the new patches. The vulnerabilities impact on-premises installations running on Windows and Linux as well as the on-premises components in hybrid deployments.
Just days earlier, on July 29, Adobe had already shipped an emergency update (version 7.4.3 build 9398). However, both that release and all prior versions remain affected by the newly disclosed flaws, necessitating another round of updates.
The most severe issues include:
- CVE-2026-48331 – a server-side request forgery (SSRF) vulnerability
- CVE-2026-48323 – an input processing flaw in the template engine
- CVE-2026-48330 – an SQL injection vulnerability
All three received a CVSSv3.1 base score of 10.0. Adobe recommends that organizations running the affected versions apply the latest fixes without delay to prevent potential exploitation.
Related articles
CISA Adds Zimbra Collaboration Suite CVE-2026-73570 to KEV Catalog After Confirmed Exploitation
US authorities have issued a warning about active exploitation of a vulnerability in the Zimbra Collaboration Suite. CISA added the OS command injection flaw CVE-2026-73570 to its Known Exploited Vulnerabilities catalog on August 21, 2026, marking the fifth such entry for the year. The issue resides in the SNMP monitoring component and allows unauthenticated attackers to execute arbitrary operating system commands with Zimbra user privileges when SNMP notifications are enabled. MITRE rated the vulnerability 8.9 on CVSS v3.1, classifying it as High severity. Federal agencies must apply mitigations by August 24, while all organizations using the product are urged to prioritize patching to prevent further abuse.
IBM Patches 191 Vulnerabilities in AIX and PowerVM VIOS Including Critical Remote Command Execution Flaws
IBM disclosed a large set of security vulnerabilities affecting its UNIX-based AIX operating system and the PowerVM VIOS virtualization component. The company addressed a total of 191 CVEs through multiple updated releases for both products. Thirty-five of the issues received CVSS base scores of 9.0 or higher, with three OS command injection vulnerabilities rated at 9.9 that allow remote attackers to execute commands with low privileges. IBM provided specific Technology Level and Service Pack updates for AIX 7.3 and 7.2 branches along with corresponding fixes for PowerVM VIOS versions 4.1.x. The advisory covers both IBM-developed code and third-party software components integrated into the platforms. All listed CVEs are now resolved in the recommended maintenance levels released on August 15.
Vulnaware Bridges Vulnerability Scanners and ITSM Systems to Improve Critical Flaw Prioritization
A new open-source tool called Vulnaware has been developed to address the persistent gap between vulnerability discovery and remediation in enterprise environments. The project focuses on intelligent prioritization rather than attempting to fix every reported CVE, recognizing that fewer than 10 percent of published vulnerabilities are ever exploited. It integrates outputs from MaxPatrol VM, Nessus Pro, and Greenbone/OpenVAS, then applies scoring based on CISA KEV catalog presence, public exploit availability from Vulncheck feeds, and trend data. Prioritized issues are automatically converted into tickets in Jira Service Management, GLPI, Znuny, and osTicket, while also delivering alerts via Telegram and email. The approach aligns with the updated CISA BOD 26-04 framework that replaced flat 15- and 25-day deadlines with risk-based timelines of 3, 14, or 60 days. By treating vulnerability remediation as a managed change or service request under ITIL4 principles, Vulnaware ensures that critical issues reach the correct engineering teams with proper SLA tracking.
PostgreSQL Releases Security Update Fixing 28 Vulnerabilities and Over 110 Bugs
The PostgreSQL development team issued a major security update on August 13, 2026, addressing 28 vulnerabilities along with more than 110 bugs. While no issues reached a CVSSv3.1 base score of 9.0 or higher, 18 vulnerabilities scored 7.0 or above, with 14 rated at 8.8. Several flaws enable arbitrary code execution, including heap buffer overflows in regular expression processing and the to_char function. Additional fixes cover heap buffer overflows in pg_stat_statements and pg_dump, type confusion issues, and an SQL injection vulnerability. The update resolves specific CVEs such as CVE-2026-14664, CVE-2026-14669, CVE-2026-14670, CVE-2026-16238, CVE-2026-16239, and CVE-2026-15741.