EUVD-2026-65617
GHSA-f3qf-7c7x-v322
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated remote SSRF chained to RCE with no user interaction and a scope change from the request-issuing component to backend systems justifies PR:N, UI:N, S:C and full C/I/A.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 2
AnalysisAI
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the running user, giving an unauthenticated network attacker full control per Adobe's CVSS:3.1 base score of 10.0 (scope-changed). The flaw lets an attacker coerce the server into making attacker-controlled requests that pivot into code execution with no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected component is a URL/resource-handling feature of Adobe Campaign Classic that performs server-side requests (CWE-918); reaching it requires network access to an exposed ACC instance, but per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed, and attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue on the signals available. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote, unauthenticated attacker sends a crafted request to an exposed Adobe Campaign Classic endpoint that accepts a server-parsed URL, coercing the ACC server to issue an attacker-directed request that is chained into code execution on the server without any user interaction. No public exploit code is identified at time of analysis, so this scenario is derived from the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Adobe's SSRF-to-RCE description rather than an observed POC. |
| Remediation | Apply the fixed Adobe Campaign Classic build identified in Adobe advisory APSB26-134 as the primary fix; the input does not include an exact fixed version number, so retrieve it from the public advisory (https://helpx.adobe.com/security/products/campaign/apsb26-134.html) rather than the internal-host link provided, which is not publicly verifiable - patch available per vendor advisory, released patched version not independently confirmed here. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Adobe Campaign Classic instances, document their network exposure, and implement firewall rules to restrict network access where possible; simultaneously subscribe to Adobe's security notification service and establish a vulnerability response team. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Remote code execution in Adobe Campaign Classic (ACC) arises from server-side template injection (CWE-1336), where impro
Server-Side Request Forgery in Adobe Campaign Classic (ACC) enables remote attackers to coerce the server into issuing c
SQL injection in Adobe Campaign Classic (ACC) allows a low-privileged, authenticated attacker to execute arbitrary code
Privilege escalation in Adobe Campaign Classic (ACC) stems from an incorrect authorization flaw (CWE-863) that lets an a
Remote code execution in Adobe Campaign Classic (ACC) lets an authenticated low-privileged attacker inject directives in
Security feature bypass in Adobe Campaign Classic (ACC) exposes sensitive data to unauthenticated remote attackers via a
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today