CVE-2026-48448

This SQL injection in Adobe Campaign Classic is a post-breach privilege escalation, not an external attack vector. The CVSS of 8.6 is accurate in severity but the EPSS score of 0.0037 correctly reflects that exploitation requires authenticated access to the Campaign workflow designer or adjacent compromised credentials. This changes your defensive posture: you are not defending a perimeter exposure—you are assuming the attacker already has some level of internal access and this CVE amplifies that access to filesystem and memory disclosure. The injection lives in the workflow scheduler (xtk:workflow with wakeup elements), specifically within workflow activities where campaign managers construct audience filters using JavaScript expressions that dynamically build SQL. These automated jobs execute on schedules with no user interaction, no audit trail, and typically no monitoring—because nobody watches scheduled database queries the way they watch user login attempts. The scope change (CWE-89 achieving CWE-200 exposure) works through PostgreSQL extensions that Adobe Campaign's database role is granted: lo_import/lo_export, COPY TO/FROM, and pg_read_binary_file provide filesystem primitives directly through SQL. The attack does not escape to the OS through traditional command injection—it leverages database-native file functions that the application's database user should never have possessed. Your immediate actions: verify whether database query auditing is enabled for Campaign Classic's PostgreSQL instance; confirm which database-level file functions (lo_import, lo_export, pg_read_binary_file) the application's database role can access and revoke them if not strictly required; and audit your workflow templates for any custom JavaScript in query activities that may contain unsanitized SQL construction. This is the third SQL injection in the query builder since 2023 (CVE-2023-29122, CVE-2023-41724). Each patch addresses a specific pathway but the underlying architectural trust—allowing campaign analysts to write JavaScript that constructs arbitrary SQL—remains. Expect future CVEs in this space until the workflow engine's SQL execution model is fundamentally refactored.

Reviewed through automated stages and approved by a human before publication.