EUVD-2026-52516
GHSA-46wv-pm82-3pv3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated no-interaction network SSRF pivoting across a scope boundary to privileged internal resources justifies AV:N/AC:L/PR:N/UI:N/S:C, with C/I:H solid and A:H accepted as vendor-asserted.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing crafted internal requests, resulting in privilege escalation without any user interaction. Adobe rates the flaw at the maximum CVSS 10.0 with a changed scope, indicating the SSRF pivots beyond the vulnerable component to compromise other systems or trust boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only network reachability to the Adobe Campaign Classic application server with no authentication and no user interaction against affected configurations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H scores a perfect 10.0: network attack vector, low complexity, no privileges, no user interaction, scope change, and high confidentiality/integrity/availability impact - the strongest possible profile for an internet- or intranet-reachable service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker who can reach the ACC application server sends a crafted request to an endpoint that accepts a URL or callback parameter, causing the server to make an internal request on the attacker's behalf. By pointing that request at a privileged internal service or metadata endpoint, the attacker retrieves credentials or triggers actions that escalate privileges, and because scope is changed the impact extends beyond the ACC component itself. … |
| Remediation | Apply the update referenced in Adobe Security Bulletin APSB26-120 (https://helpx.adobe.com/security/products/campaign/apsb26-120.html) - Patch available per vendor advisory; the exact fixed build number was not included in the source data, so confirm the target version directly from that bulletin before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct a rapid inventory of all Adobe Campaign Classic instances and their network exposure, implement strict network segmentation to limit campaign server outbound access to only required destinations, and activate security event alerting for suspicious SSRF indicators (crafted URIs, internal metadata requests, localhost access attempts). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an a
Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives in
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today