Cyber Threat Brief — August 2 2026

⚠️ This report is AI-generated. Always validate findings.

1. Adobe Campaign Classic Pre-Auth RCE — CVE-2026-48449

TL;DR: Adobe patched a CVSS 10.0 incorrect authorization flaw in Campaign Classic that enables unauthenticated RCE with no user interaction; companion SQLi (CVE-2026-48448) enables arbitrary file read. No ITW exploitation yet — patch now before PoC drops.

What’s New:

  • Adobe security bulletin APSB26-114 released August 1 with fix in ACC v7 build 9398
  • CVE-2026-48449: CWE-863 incorrect authorization → pre-auth RCE, CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C)
  • CVE-2026-48448: CVSS 8.6 SQL injection → arbitrary file read, chains with 48449 for full compromise
  • Scope Changed flag means exploitation can pivot beyond the Campaign Classic application boundary
  • No public PoC or ITW exploitation yet — Adobe is not aware of any attacks

Actionable Intel

ArtifactTypeATT&CKLog SourceAction
ACC v7 builds ≤ 9397Vulnerable versionT1190Asset inventoryIdentify and patch all ACC instances to build 9398
Unauthenticated API access to ACCExploitation pathT1190, T1059IIS/Apache access logs, ACC application logsMonitor for anomalous unauthenticated requests to ACC API endpoints
SQLi via CVE-2026-48448File read primitiveT1190, T0005WAF logs, ACC database logsAlert on SQL error signatures and unusual file read patterns from ACC process
ACC network exposureAttack surfaceT1190Firewall logsAudit and restrict internet exposure of ACC instances; segment from production data

Detection

SourceRuleGap
Splunk ESCUNoneNo ACC-specific detection; need WAF/proxy rule for anomalous unauthenticated ACC API calls
ElasticNoneNo rule for ACC exploitation indicators
SigmaNoneNo rule; need web application log monitoring for ACC authorization bypass patterns

Sources: The Hacker News: Adobe Campaign Classic CVSS 10.0, SecurityAffairs: Adobe fixed maximum-severity flaw, GBHackers: Critical Adobe Campaign Flaw


Status Updates

  • CVE-2026-20316 (Cisco Secure FMC): Federal CISA KEV deadline passed August 1. Hardcoded static credential zero-day exploitation ongoing. Chains with CVE-2026-20079 for privilege escalation. Hot fixes available for 7.0/7.2/7.4/7.6/7.7/10.0 branches. Original brief.
  • CVE-2026-6875 (ServiceNow AI Platform): Active exploitation ongoing since July 18 — two weeks without CISA KEV listing. Two sandbox-escape gadget chains confirmed. Fortune 500 and critical infrastructure victims. Treat as high-priority patch regardless of KEV status.
  • CVE-2026-12569 (PTC Windchill/FlexPLM): Cl0p ransomware extortion ongoing via support@cryptohox[.]com. JSP webshells under /Windchill/login/[0-9a-f]{16}.jsp. C2 IP 5.180.41.35. Original brief.
  • LegacyHive-Windows-LPE: Still UNPATCHED by Microsoft. ACROS Security 0patch micropatches available since July 20. Original brief.