EUVD-2026-84663
GHSA-r46f-32qw-5rrj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged ACC user
-
DeliverySubmit request with attacker-controlled URL
-
ExploitServer issues forged internal request (SSRF)
-
ExecutionReach internal-only resources
-
ImpactEscalate to elevated access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged Adobe Campaign Classic account (PR:L) with network reachability to the ACC application; no user interaction is needed (UI:N). Exploitation depends on an ACC feature that accepts an attacker-influenced URL/resource reference and issues a server-side request on the attacker's behalf, allowing it to reach internal resources beyond the attacker's authorization boundary. The limiting factor is the authentication requirement - the attacker must first obtain valid low-privileged credentials - but there is no indication of a non-default configuration prerequisite. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9 Critical) describes network-reachable, low-complexity, low-privilege exploitation with a scope change - a serious profile on paper. However, several risk-tempering signals qualify this. Exploitation status: no public exploit identified at time of analysis (no CISA KEV listing, no POC referenced, no EPSS score provided in the input). The single source is Adobe's own advisory (APSB26-142), so the finding is vendor-self-reported and not corroborated by an independent researcher, NVD enrichment, or exploitation telemetry. Most importantly, the vendor's I:H/A:H claim appears overstated for a CWE-918 SSRF whose described outcome is 'privilege escalation / elevated access to internal resources' - that primarily maps to a confidentiality/access-boundary impact (C:H), not directly to full integrity and availability compromise; the 9.9 score is inflated by the S:C and I:H/A:H assignments. My independent assessment (~C:H/I:L/A:N, ~7.6) is more consistent with SSRF behavior. Net: prioritize because it is authenticated-but-low-barrier and network-facing, but treat the 9.9 as a vendor-maximal figure rather than a validated worst case, and note this is one of a large APSB26-142 batch of ACC issues. |
| Exploit ScenarioDerived | An attacker holding a low-privileged Adobe Campaign Classic account submits a crafted request that causes the server to make attacker-controlled outbound requests to internal-only endpoints. With AV:N/AC:L/PR:L and no user interaction, the attacker reaches internal resources (e.g., metadata services, internal admin interfaces) that its own privilege level should not access, achieving elevated access. No public exploit code is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Server-side request forgery in Adobe Campaign Classic lets an authenticated, low-privileged user force the ACC application server to issue requests to internal or otherwise unreachable resources, turning the account into a foothold for reading confidential internal services (CWE-918; CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). Adobe scores the issue 9.9 Critical, while our assessment keeps the scope change and high confidentiality impact but rates integrity as Low - the dominant effect is unauthorized reach into internal resources rather than direct tampering with protected data - which places effective risk in High territory (≈8.5) rather than Critical. Exploitation requires valid low-privileged ACC credentials and network reachability to the application, needs no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis.
RemediationAI
Apply the fixed Adobe Campaign Classic build identified in Adobe security bulletin APSB26-142 (https://helpx.adobe.com/security/products/campaign/apsb26-142.html); no vendor-released patch version is confirmed in the data available here, so the bulletin must be checked for the exact remediated build before declaring an environment clean. Where patching cannot be performed immediately, the highest-value compensating control is egress filtering on the ACC application servers: allow outbound traffic only to inventoried legitimate destinations and deny RFC1918 ranges, loopback, and the cloud metadata endpoint 169.254.169.254, which directly removes the SSRF's ability to reach internal services, at the trade-off of breaking any unlisted integration, webhook, or connector until it is added to the allowlist. Blocking metadata access should be paired with IMDSv2 enforcement or a metadata hop-limit on cloud instances, accepting that some agents require restart or reconfiguration. In parallel, restrict ACC functionality that fetches external URLs or external accounts to trusted administrative roles and remove or disable unused URL-consuming features, which costs some marketing workflow flexibility but shrinks the attack surface, and tighten identity hygiene by disabling unused low-privilege accounts, enforcing MFA, and alerting on outbound requests from ACC servers to unexpected internal destinations - the last being detective rather than preventive and therefore only a stopgap until remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-82013 is a classic server-side request forgery (SSRF) rooted in CWE-918: some ACC feature accepts an attacker-influenced URL or resource reference and then performs the outbound request from the ACC application server, so the request originates inside the trusted network perimeter rather than from the attacker's host. Adobe Campaign Classic is a marketing automation platform that stores customer schemas, workflows, and web applications and frequently sits alongside internal APIs, databases, and administrative services; an SSRF in that position allows an attacker to enumerate and query those services with the server's network position and potentially its service identity. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C means the bug is network-reachable at low complexity, requires a low-privileged authenticated account, needs no victim interaction, and causes a scope change - the vulnerable component (ACC) and the impacted component (the internal resources it can reach) are different security authorities, which is why the score scales sharply even with a low-privilege prerequisite. Our assessment deliberately differs from the vendor vector only on integrity (I:L instead of I:H), so the CPE string cpe:2.3:a:adobe:adobe_campaign_classic:*:*:*:*:*:*:*:* with its unrestricted version wildcard indicates the flaw is not confined to a single release and affects the product line at large.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSRF-to-privesc primarily grants read/reach to internal resources (C:H) with limited integrity effect (I:L) and no direct availability impact (A:N); PR:L and S:C retained per the described low-privileged, boundary-crossing behavior.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe Campaign Classic contains a server-side request forgery flaw (CVE-2026-82013) that lets any authenticated user with even minimal account privileges pivot the application server into contacting internal systems that should never be reachable from a marketing tool. Because ACC servers normally sit inside the perimeter with broad trust to internal services, one ordinary campaign account - including those held by agencies, contractors, or junior staff - could become a gateway to confidential internal data. Leadership should care because the barrier to entry is low (valid credentials plus network reach to the app), the confidentiality exposure is high, and no vendor fix is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to the ACC application server (VPN or IP allowlist only); reduce the population of valid low-privileged ACC credentials and enforce MFA; apply strict outbound egress filtering so the ACC server can only reach approved external destinations and cannot reach internal RFC1918 ranges, internal hostnames, or cloud metadata services; monitor and alert on anomalous outbound requests originating from the ACC host.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Exploit-DB