Adobe Campaign Classic Is on Fire, WordPress Logins Are Being Bypassed, and Your Patch Queue Just Got Longer
Three CVSS 10.0 scores landed in the NVD in a single 24-hour window. CISA added a Gitea code injection to its Known Exploited Vulnerabilities catalogue. And attackers are actively scanning WordPress sites for a login bypass that hands over administrator access without a valid password.
This is not a quiet August news cycle. Let’s go through what matters and what you should do about it.
Story One: Adobe Campaign Classic Has Three Maximum-Severity Vulnerabilities
CVSS 10.0 is the maximum possible score on the Common Vulnerability Scoring System. It is assigned when a vulnerability is remotely exploitable, requires no user interaction, and results in full compromise of confidentiality, integrity, and availability. Getting one in a product in a single week is notable. Getting three in the same product in the same 24-hour window is extraordinary.
Adobe Campaign Classic (ACC) is affected by CVE-2026-76193, CVE-2026-76195, and CVE-2026-76197. The first is a Server-Side Request Forgery vulnerability that results in arbitrary code execution. The other two are OS Command Injection flaws, also resulting in arbitrary code execution. In all three cases: no user interaction is required, and the scope is changed, meaning a successful attack can affect components beyond the vulnerable product itself.
Who uses Adobe Campaign Classic? Larger marketing teams, typically. But it is also deployed by agencies and managed service providers working on behalf of smaller clients. If your email marketing is handled by a third party, this is the question to ask them today: Has your Adobe Campaign Classic environment been patched against CVE-2026-76193, CVE-2026-76195, and CVE-2026-76197?
If they cannot answer that question clearly and quickly, that tells you something about the maturity of their patch management.
Adobe has issued fixes. The action is straightforward: apply them. The risk of not doing so is arbitrary code execution by an unauthenticated remote attacker. There is no nuance here.
Story Two: WordPress Admin Bypass Is Being Actively Exploited Right Now
WordPress powers a significant proportion of UK small business websites. It is estimated to underpin roughly 43% of all websites globally, and the small business segment is heavily represented in that figure. The plugin ecosystem is both its greatest strength and its most consistent attack surface.
This week, attackers are actively scanning for and exploiting two severe authentication bypass vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On plugin. The flaws, which include CVE-2026-15981, allow an unauthenticated attacker to sign in as any user on the site, including the site administrator, without supplying valid credentials.
Let that sit for a moment. No password required. Full administrator access.
The miniOrange SAML plugin is used by organisations that have configured WordPress to authenticate via a corporate identity provider, often as part of a more professional or enterprise-style setup. If your business or your web agency has configured this on your site, and the plugin has not been updated, the site should be treated as compromised until proven otherwise.
The practical checks are these. Log into your WordPress admin dashboard. Go to Plugins. Find miniOrange SAML 2.0 Single Sign On. If it is installed, check the version. If it is not on the latest release, update it immediately. If you do not actively use it, deactivate and delete it. Unused plugins are attack surface with no compensating benefit.
If you do not have access to do this yourself, contact whoever manages your website today, not at your next scheduled check-in.
Story Three: Gitea Code Injection Is Confirmed Exploited in the Wild
Gitea is an open-source self-hosted Git service, commonly used by small development teams and managed service providers who want to host their own code repositories rather than using GitHub or GitLab. It is lightweight, easy to deploy, and popular precisely because it does not require enterprise licensing.
CVE-2026-60004 is a code injection vulnerability in Gitea that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint, plant an executable Git hook, and run arbitrary shell commands as the Gitea service account. CISA added this to its Known Exploited Vulnerabilities catalogue on 25 August 2026, which means it has been confirmed as actively exploited in real attacks, not just theoretically weaponisable.
The threat model here is important. The attacker does not need administrator access to the Gitea instance. They need repository write access. In small teams with relaxed permission management, that may be most users. In environments where contractors or freelancers have been granted access, the attack surface widens further.
If your business or your MSP runs a self-hosted Gitea instance, the required actions are: apply the vendor patch immediately, audit who currently has write access to each repository, review recent commits and hook configurations for anomalous entries, and check the Gitea service account’s permissions on the underlying system.
This is not a vulnerability that can be mitigated by network controls alone. The attack originates from authenticated users with legitimate access.
Why This Matters for Supply Chain Risk
These three stories have a connecting thread that is worth making explicit for UK small business owners.
You may not run Adobe Campaign Classic. You may not have a self-hosted Gitea instance. But your marketing agency might. Your MSP might. Your web developer almost certainly runs WordPress on your behalf.
The small business is not always the direct target. It is often the path. Attackers compromise the tools used by your suppliers and service providers, and from there they reach you: your data, your customer records, your payment systems, your email.
Supply chain risk is not an abstract enterprise concern. It is the reason your three-person marketing agency’s compromised CRM becomes your GDPR notification obligation.
Ask your suppliers and service providers direct questions this week. Which of these vulnerabilities affect your stack? Have you patched? Can you evidence it?
How to Use This as a Competitive Advantage
If you are a business that can honestly say you maintain an active patching process, audit your suppliers’ security posture, and stay current with CISA and NCSC advisories, that is a differentiator. Not because you should advertise it aggressively, but because when a client asks the question, you have a real answer.
Many businesses your size cannot say that. Most do not even know these vulnerabilities exist, let alone whether their stack is affected. The gap between businesses that treat security as operational hygiene and those that treat it as checkbox theatre is widening. The costs of being on the wrong side of that gap are increasingly visible: ransomware, ICO investigations, reputational damage, lost contracts.
If you have clients in regulated sectors, finance, legal, healthcare, knowing that your security posture is current is increasingly a procurement requirement, not a nice-to-have. Document what you do and when you do it.
Making the Business Case
For those who need to brief a director, a board, or a budget holder, here are three arguments that hold up.
The cost of patching is fixed. The cost of a breach is not. Adobe Campaign Classic vulnerabilities of this severity can result in full system compromise. The downstream cost of a breach, incident response, customer notification, regulatory engagement, reputational damage, is unpredictable and potentially existential for a small business. The cost of applying a patch is measurable and bounded.
Regulators are watching the supply chain. The ICO has been explicit that GDPR accountability extends to data processors and sub-processors. If a third-party tool you or your suppliers use is compromised because it was not patched, and customer data is exposed, the liability does not disappear because the tool was run by someone else.
CISA-confirmed exploitation means it is happening now. The Known Exploited Vulnerabilities catalogue is not a theoretical risk register. CISA adds vulnerabilities to it when exploitation has been observed in the wild. CVE-2026-60004 is being actively used. The question is not whether someone will try to exploit it. The question is whether your environment is patched before they do.
What to Do Before Friday
1. Check your Adobe Campaign Classic version today. If you or your email marketing provider uses ACC, confirm the patch status against CVE-2026-76193, CVE-2026-76195, and CVE-2026-76197. Apply available fixes immediately. If your provider cannot confirm patch status, escalate.
2. Audit your WordPress plugins. Log in to every WordPress site your business operates or has responsibility for. Check for the miniOrange SAML 2.0 Single Sign On plugin. If installed, update it to the latest version immediately. If unused, delete it. While you are there, apply any other pending plugin updates.
3. Patch or isolate your Gitea instance. If you or your MSP runs self-hosted Gitea, apply the vendor patch for CVE-2026-60004 immediately. Audit repository write permissions and remove access for any accounts that do not require it. Review recent hook configurations.
4. Ask your suppliers the direct questions. Contact your marketing agency, your MSP, your web developer, and your CRM provider. Ask: are you affected by this week’s Adobe Campaign, WordPress, or Gitea vulnerabilities? Have you patched? When can you confirm? If you do not get clear answers, treat that as a risk signal.
5. Subscribe to NCSC alerts. The NCSC publishes free vulnerability alerts and early warnings at ncsc.gov.uk. If you are not subscribed, you are operating without the most basic available intelligence. It takes five minutes to set up.
Before you go: follow the show wherever you listen, leave a rating or a review, drop a comment with your thoughts, and share this episode with someone who would find it useful. If it saves one business from a preventable breach this week, it has done its job.