Adobe Campaign Classic CVE-2026-82443

Requires an authenticated low-privileged account on an Adobe Campaign Classic (Classic v7) instance - PR:L means valid credentials/access to the application are needed, so this is not remote-unauthenticated. No user interaction is required (UI:N). Exploitation targets ACC builds up to and including 7.4.4 build 9401. Realistic impact is greatest where the ACC server has network reachability to sensitive internal services (metadata endpoints, internal admin interfaces, other backend systems) that the low-privileged user cannot reach directly; the scope change (S:C) reflects the SSRF crossing that internal boundary. Limiting factors: attacker must already hold a low-privilege account, SSVC marks it non-automatable (no reliable mass exploitation), and no exploit is public - so realistic risk is targeted/insider or post-foothold rather than opportunistic internet-wide scanning.

This is a genuinely serious flaw but not a top-of-queue emergency, and the signals partly conflict. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) paints a near-maximal picture: network-reachable, low complexity, only low privileges needed, no user interaction, and a scope change yielding total confidentiality/integrity/availability impact. However, CISA's SSVC framework tells a calmer story - Exploitation: none (no observed activity or public exploit), Automatable: no (cannot be reliably mass-exploited), Technical Impact: total. EPSS is only 0.73% (53rd percentile), consistent with 'no public exploit identified' and not-yet-exploited. There is no CISA KEV listing and no known POC. There is also an internal tension worth flagging: the CWE is SSRF (CWE-918), which typically drives confidentiality/pivot impact, yet the vendor rates I:H and A:H as 'total' - the description only concretely establishes SSRF enabling privilege escalation and reaching internal resources, so the full A:H/I:H may be an upper-bound vendor rating rather than a demonstrated outcome; verify precise impact with Adobe APSB26-142. Net: prioritize patching for internet-exposed or multi-tenant ACC instances given PR:L + scope change, but the absence of exploitation, low automatability, and low EPSS mean this is targeted-risk, not wormable/opportunistic.

A low-privileged authenticated user of an Adobe Campaign Classic instance submits a crafted request that causes the ACC server to make attacker-controlled outbound requests (SSRF), pivoting to internal resources and services not directly reachable by the attacker. Because scope is changed, the server-side request is leveraged to reach internal endpoints and escalate to elevated access beyond the attacker's original privilege boundary. No public exploit code is identified and no active exploitation is reported, so this remains a plausible-but-unproven chain based on the vendor description.