Adobe Campaign Classic CVE-2026-48331

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only network reachability to the Adobe Campaign Classic application server with no authentication and no user interaction against affected configurations. The core prerequisite is that an attacker-controllable URL/destination is passed to a server-side request function in ACC (the SSRF sink), and that the ACC server has network paths to valuable internal targets (metadata services, internal admin/APIs, datastores) for the privilege-escalation payoff. Limiting factors: exploitation value depends on what internal resources the ACC host can actually reach, so network segmentation and strict egress filtering materially constrain real-world impact; the exact affected build range from APSB26-120 also bounds which deployments are vulnerable.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H scores a perfect 10.0: network attack vector, low complexity, no privileges, no user interaction, scope change, and high confidentiality/integrity/availability impact - the strongest possible profile for an internet- or intranet-reachable service. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public proof-of-concept was referenced, so this is a high-CVSS, credible-but-not-yet-observed-exploitation issue rather than a confirmed active-exploitation event. One caveat worth verifying with the vendor: SSRF flaws often warrant a more conservative availability rating than A:H, and the maximal 10.0 with S:C reflects Adobe's assessment of the downstream privilege-escalation impact - treat the combined C:H/I:H/A:H as vendor-asserted rather than independently confirmed. Given an unauthenticated, no-interaction network vector against enterprise marketing infrastructure, this should be prioritized for immediate patching regardless of the missing EPSS/KEV signals.

A remote attacker who can reach the ACC application server sends a crafted request to an endpoint that accepts a URL or callback parameter, causing the server to make an internal request on the attacker's behalf. By pointing that request at a privileged internal service or metadata endpoint, the attacker retrieves credentials or triggers actions that escalate privileges, and because scope is changed the impact extends beyond the ACC component itself. No public proof-of-concept was identified, but the low attack complexity and absence of authentication or user interaction make weaponization straightforward once endpoint details are known.