Cyber Threat Brief — August 2 2026
⚠️ This report is AI-generated. Always validate findings.
1. Adobe Campaign Classic Pre-Auth RCE — CVE-2026-48449
TL;DR: Adobe patched a CVSS 10.0 incorrect authorization flaw in Campaign Classic that enables unauthenticated RCE with no user interaction; companion SQLi (CVE-2026-48448) enables arbitrary file read. No ITW exploitation yet — patch now before PoC drops.
What’s New:
- Adobe security bulletin APSB26-114 released August 1 with fix in ACC v7 build 9398
- CVE-2026-48449: CWE-863 incorrect authorization → pre-auth RCE, CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C)
- CVE-2026-48448: CVSS 8.6 SQL injection → arbitrary file read, chains with 48449 for full compromise
- Scope Changed flag means exploitation can pivot beyond the Campaign Classic application boundary
- No public PoC or ITW exploitation yet — Adobe is not aware of any attacks
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| ACC v7 builds ≤ 9397 | Vulnerable version | T1190 | Asset inventory | Identify and patch all ACC instances to build 9398 |
| Unauthenticated API access to ACC | Exploitation path | T1190, T1059 | IIS/Apache access logs, ACC application logs | Monitor for anomalous unauthenticated requests to ACC API endpoints |
| SQLi via CVE-2026-48448 | File read primitive | T1190, T0005 | WAF logs, ACC database logs | Alert on SQL error signatures and unusual file read patterns from ACC process |
| ACC network exposure | Attack surface | T1190 | Firewall logs | Audit and restrict internet exposure of ACC instances; segment from production data |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No ACC-specific detection; need WAF/proxy rule for anomalous unauthenticated ACC API calls |
| Elastic | None | No rule for ACC exploitation indicators |
| Sigma | None | No rule; need web application log monitoring for ACC authorization bypass patterns |
Sources: The Hacker News: Adobe Campaign Classic CVSS 10.0, SecurityAffairs: Adobe fixed maximum-severity flaw, GBHackers: Critical Adobe Campaign Flaw
Status Updates
- CVE-2026-20316 (Cisco Secure FMC): Federal CISA KEV deadline passed August 1. Hardcoded static credential zero-day exploitation ongoing. Chains with CVE-2026-20079 for privilege escalation. Hot fixes available for 7.0/7.2/7.4/7.6/7.7/10.0 branches. Original brief.
- CVE-2026-6875 (ServiceNow AI Platform): Active exploitation ongoing since July 18 — two weeks without CISA KEV listing. Two sandbox-escape gadget chains confirmed. Fortune 500 and critical infrastructure victims. Treat as high-priority patch regardless of KEV status.
- CVE-2026-12569 (PTC Windchill/FlexPLM): Cl0p ransomware extortion ongoing via support@cryptohox[.]com. JSP webshells under
/Windchill/login/[0-9a-f]{16}.jsp. C2 IP 5.180.41.35. Original brief. - LegacyHive-Windows-LPE: Still UNPATCHED by Microsoft. ACROS Security 0patch micropatches available since July 20. Original brief.