EUVD-2026-84664
GHSA-5x4j-5f5v-fwp3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ACC endpoint
-
DeliverySend crafted SSRF request
-
ExploitServer issues attacker-controlled internal request
-
ExecutionAccess internal service/resource
-
ImpactEscalate privileges across scope boundary
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions per CVSS - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against reachable Adobe Campaign Classic instances at or below version 7.4.4 build 9401. The primary limiting factor is network exposure: the ACC application endpoint must be reachable by the attacker, and the SSRF's value depends on the existence of exploitable internal services or resources behind it that the coerced request can reach. No user interaction and no authentication are required. Adobe does not document a specific non-default feature or configuration prerequisite, so the flaw appears exploitable against default deployments within the affected version range. |
| Impact | This is a vendor-reported (Adobe) SSRF flaw (CWE-918) carrying the maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), driven by network reachability, no authentication, no user interaction, a changed scope, and triple-high impact. However, the exploitation signals temper that headline number: EPSS is only 0.69% (51st percentile), CISA KEV does NOT list it, and no public POC is referenced - status is 'no public exploit identified at time of analysis.' There is no SSVC decision record in the input to corroborate automatability or technical impact. The tension here is a perfect 10.0 versus a middling EPSS and absent exploitation evidence, which is typical of freshly vendor-disclosed Adobe issues rather than mass-exploited bugs. Note also that a full C:H/I:H/A:H triple-high rating for an SSRF is aggressive: SSRF primarily yields confidentiality/pivot impact, and the description gives no technical detail (no mention of internal endpoints reached, metadata theft, or command execution) to independently justify high integrity and availability impact - this should be verified against Adobe APSB26-142. Realistic priority: patch promptly given unauthenticated network reachability on an enterprise marketing platform, but there is no evidence of active or widespread exploitation to date. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted request to an internet-reachable Adobe Campaign Classic instance that coerces the server into making attacker-controlled outbound requests to internal systems, enabling access to internal services or resources and ultimately privilege escalation across a scope boundary. No user interaction is required and no credentials are needed per the CVSS vector (PR:N/UI:N). No public proof-of-concept exploit is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 23, 2026
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauthenticated attackers induce the ACC server to issue arbitrary requests to other systems, which the vendor rates as a privilege-escalation risk with a changed scope and a maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No authentication or user interaction is required per the vendor vector, so the practical limiting factor is whether the ACC endpoint is reachable by the attacker and whether exploitable internal services sit behind it; Adobe does not document a non-default configuration prerequisite, so default deployments in the affected range appear exposed. Exploitation status at time of analysis is that no public exploit has been identified, and EPSS is a modest 0.69% (51st percentile), though the vendor's high impact rating and the absence of preconditions justify prompt patching. An independent recalibration prefers C:H/I:L/A:N over the vendor's triple-high impact, so the 10.0 figure should be read as Adobe's upper-bound claim rather than a confirmed blast radius.
Earlier versions of this analysis (1)
Server-side request forgery in Adobe Campaign Classic lets unauthenticated, network-reachable attackers coerce the ACC server into issuing requests to arbitrary destinations, which can expose internal services and be chained into privilege escalation. Adobe rates the issue 9.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L), meaning no authentication and no user interaction are required, the scope changes, confidentiality impact is high, and integrity/availability impacts are partial. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so practical urgency depends on whether the ACC instance is internet- or intranet-exposed rather than on observed attacks.
RemediationAI
Patch per vendor advisory: Adobe has published APSB26-142 (https://helpx.adobe.com/security/products/campaign/apsb26-142.html), which is the authoritative source for the fixed ACC build - patch availability is confirmed by the advisory, but the exact fixed version string is not enumerated in the supplied data, so confirm the target build on that page before upgrading rather than assuming a version number, and note the affected ceiling is 7.4.4 build 9401. Until the upgrade is applied, the most effective compensating control is network containment of ACC: place the ACC web/application endpoints behind a VPN, IP allowlist, or WAF so only trusted administration networks can reach them, accepting that this breaks legitimate external campaign-preview or client-access workflows. Second, restrict outbound egress from ACC server hosts so that requests to RFC1918 ranges, loopback, and the cloud metadata address 169.254.169.254 are blocked at the host firewall or proxy, and enforce IMDSv2 on AWS-hosted instances so metadata theft via SSRF yields no usable credentials; the trade-off is that legitimate ACC integrations calling internal services on those ranges must be explicitly allowlisted, which is operationally intensive. Third, disable or remove unused external connectors, delivery/mid-sourcing endpoints, and URL-fetching features in the ACC console so fewer server-side request primitives remain reachable, accepting reduced functionality. Given the unauthenticated, no-user-interaction vector, monitoring ACC server logs for anomalous outbound requests to internal or link-local addresses provides a detection layer while remediation is pending.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-918 (Server-Side Request Forgery) in Adobe Campaign Classic, a marketing-automation and campaign-management platform whose server components routinely make outbound HTTP/SOAP requests to internal application servers, mid-sourcing instances, message-delivery endpoints, and cloud services. Because the ACC server accepts a URL or resource reference that it then fetches on the caller's behalf without adequately validating the destination, an attacker can coerce it into requesting internal-only hosts, admin interfaces, cloud instance-metadata endpoints (e.g. 169.254.169.254), or other services that the attacker cannot reach directly. The vendor's CVSS vector includes S:C (scope changed), meaning successful exploitation is assessed to cross a trust boundary and affect resources outside the vulnerable component - this is what turns an SSRF into a privilege-escalation finding, since the coerced requests can reach higher-privileged internal APIs or harvest credentials from metadata services. The vector PR:N/UI:N confirms remote, unauthenticated triggering with no user interaction, so the attack surface is any network-reachable ACC web/application endpoint. The CPE cpe:2.3:a:adobe:adobe_campaign_classic:*:*:*:*:*:*:*:* with the EUVD range 'Adobe Campaign Classic 0 <= 7.4.4 build 9401' defines the affected deployment set; anything above build 9401 of the 7.4.4 line (or a later release) is outside the stated range. An independent reassessment keeps the same attack vector, complexity, privilege, interaction, and scope metrics but scores impact as C:H/I:L/A:N, indicating that while confidentiality loss (e.g. credential or configuration disclosure via internal requests) is credible, integrity and availability impact are judged less certain than Adobe's H/H/H rating.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network SSRF with scope change (S:C) warrants high confidentiality via internal access, but sparse detail does not substantiate high integrity or any availability impact.
Primary rating from Vendor (adobe).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe Campaign Classic deployments at or below version 7.4.4 build 9401 carry a maximum-severity server-side request forgery flaw that requires no credentials or user interaction to trigger, meaning anyone who can reach the platform's endpoint could potentially redirect it to act against internal systems. Because no vendor patch is currently available, every affected marketing and campaign platform instance is exposed until mitigations are applied, and the blast radius extends beyond the ACC environment to whatever internal services sit behind it - including identity, data, and administrative systems that trust the ACC network position. Leadership should care because the platform typically holds large volumes of customer data and connects to CRM, email, and analytics infrastructure, so a single reachable instance becomes a pivot point for broader compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to the ACC endpoint via firewall and allowlist rules to eliminate exposure to unauthenticated remote attackers; enforce strict egress allowlisting on ACC hosts to prevent server-initiated requests to internal systems; isolate affected ACC instances in a segmented network zone with no direct path to identity, database, or administrative services; enforce least-privilege on ACC service accounts; enable and monitor outbound connection logging from ACC servers for anomalous requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Exploit-DB