EUVD-2026-65617
GHSA-f3qf-7c7x-v322
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ACC endpoint
-
DeliverySend crafted SSRF request
-
ExploitCoerce server-side request to internal target
-
ExecutionChain SSRF into code execution
-
PersistRun arbitrary code as current user
-
ImpactPivot across changed scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected component is a URL/resource-handling feature of Adobe Campaign Classic that performs server-side requests (CWE-918); reaching it requires network access to an exposed ACC instance, but per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed, and attack complexity is low (AC:L). The practical limiting factors are therefore deployment-related rather than attacker-privilege-related: the ACC server (or the specific vulnerable endpoint) must be network-reachable by the attacker, and exploitation runs in the context of the current user, so the impact ceiling is bounded by the privileges of the ACC service principal. The input does not name the exact vulnerable feature/parameter, so the precise triggering endpoint should be confirmed from the vendor advisory. |
| Impact | This is a genuine top-priority issue on the signals available. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a maximal 10.0: remote, low-complexity, unauthenticated, no user interaction, scope change, and total confidentiality/integrity/availability impact. SSRF chained to RCE with PR:N is the highest-urgency category of flaw. However, several corroborating signals are missing: no EPSS score was provided (exploitation probability cannot be quantified), KEV status is not present (no evidence of active exploitation), and no POC availability is indicated - so exploitation likelihood is currently unquantified rather than confirmed low or high. There is also mild internal tension worth verifying: 'arbitrary code execution in the context of the current user' implies execution under whatever principal the ACC service/session runs as, which the vector nonetheless models as PR:N (attacker needs no privileges to launch it). Treat the 10.0 as the design-basis severity, but confirm affected versions and fixed builds against a verified Adobe advisory before final prioritization. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to an exposed Adobe Campaign Classic endpoint that accepts a server-parsed URL, coercing the ACC server to issue an attacker-directed request that is chained into code execution on the server without any user interaction. No public exploit code is identified at time of analysis, so this scenario is derived from the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Adobe's SSRF-to-RCE description rather than an observed POC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Server-side request forgery in Adobe Campaign Classic (ACC) escalates to arbitrary code execution in the context of the running user, giving an unauthenticated network attacker full control per Adobe's CVSS:3.1 base score of 10.0 (scope-changed). The flaw lets an attacker coerce the server into making attacker-controlled requests that pivot into code execution with no user interaction. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the only reference is an Adobe advisory (APSB26-134) served from an internal, non-public host and could not be independently verified.
RemediationAI
Apply the fixed Adobe Campaign Classic build identified in Adobe advisory APSB26-134 as the primary fix; the input does not include an exact fixed version number, so retrieve it from the public advisory (https://helpx.adobe.com/security/products/campaign/apsb26-134.html) rather than the internal-host link provided, which is not publicly verifiable - patch available per vendor advisory, released patched version not independently confirmed here. As compensating controls until patched: place the ACC application/instance behind strict egress filtering so the server can only reach explicitly allow-listed internal hosts and deny it outbound access to internal metadata endpoints and lateral internal services (this blocks the SSRF pivot but may break legitimate outbound integrations, so allow-list required endpoints); restrict network reachability of the vulnerable ACC endpoints to trusted management networks or via VPN/WAF rules that reject unexpected URL/redirect parameters (trade-off: WAF URL-scheme filtering can produce false positives on legitimate campaign content); and monitor ACC server logs for anomalous outbound requests. Do not treat network controls as a substitute for the vendor patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Campaign Classic is Adobe's on-premise/hybrid cross-channel marketing and campaign-orchestration platform (email, delivery, workflow, and data-management server tier). The root cause is CWE-918 (Server-Side Request Forgery): the application accepts a URL or resource identifier and issues a server-side request without adequately validating or restricting the destination, allowing an attacker to redirect that request to internal services or resources. In this case the SSRF does not stop at internal reconnaissance - Adobe states it results in arbitrary code execution in the context of the current user, indicating the coerced request reaches a component that can be leveraged to run code. The affected CPE is cpe:2.3:a:adobe:adobe_campaign_classic:*:*:*:*:*:*:*:*, which spans all versions without a fixed version boundary encoded in the CPE.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated remote SSRF chained to RCE with no user interaction and a scope change from the request-issuing component to backend systems justifies PR:N, UI:N, S:C and full C/I/A.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
Articles & Coverage 2
Executive ViewAI
Adobe Campaign Classic (ACC) contains a critical server-side request forgery vulnerability that allows unauthenticated remote attackers to execute arbitrary code on affected servers, creating risk of data breach, campaign manipulation, and network compromise. With a CVSS 10.0 score and no available patch, this vulnerability requires immediate mitigation to prevent potential exploitation. Organizations with internet-facing or network-accessible ACC deployments face substantial risk until vendor patches are released.
No vendor-released patch identified at time of analysis; no public exploit identified at time of analysis. Interim mitigations: implement network segmentation to restrict unauthenticated access to ACC systems, deploy Web Application Firewall rules to detect and block server-side request forgery attack patterns, air-gap ACC systems from untrusted networks, and enable detailed logging and monitoring for exploitation attempts until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Exploit-DB