EUVD-2026-84655
GHSA-qh7v-x4fm-xhfj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged ACC user
-
DeliverySubmit crafted SSRF request
-
ExploitServer issues attacker-controlled internal request
-
ExecutionReach internal resources across scope boundary
-
ImpactEscalate to elevated access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privileged account on an Adobe Campaign Classic (Classic v7) instance - PR:L means valid credentials/access to the application are needed, so this is not remote-unauthenticated. No user interaction is required (UI:N). Exploitation targets ACC builds up to and including 7.4.4 build 9401. Realistic impact is greatest where the ACC server has network reachability to sensitive internal services (metadata endpoints, internal admin interfaces, other backend systems) that the low-privileged user cannot reach directly; the scope change (S:C) reflects the SSRF crossing that internal boundary. Limiting factors: attacker must already hold a low-privilege account, SSVC marks it non-automatable (no reliable mass exploitation), and no exploit is public - so realistic risk is targeted/insider or post-foothold rather than opportunistic internet-wide scanning. |
| Impact | This is a genuinely serious flaw but not a top-of-queue emergency, and the signals partly conflict. The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) paints a near-maximal picture: network-reachable, low complexity, only low privileges needed, no user interaction, and a scope change yielding total confidentiality/integrity/availability impact. However, CISA's SSVC framework tells a calmer story - Exploitation: none (no observed activity or public exploit), Automatable: no (cannot be reliably mass-exploited), Technical Impact: total. EPSS is only 0.73% (53rd percentile), consistent with 'no public exploit identified' and not-yet-exploited. There is no CISA KEV listing and no known POC. There is also an internal tension worth flagging: the CWE is SSRF (CWE-918), which typically drives confidentiality/pivot impact, yet the vendor rates I:H and A:H as 'total' - the description only concretely establishes SSRF enabling privilege escalation and reaching internal resources, so the full A:H/I:H may be an upper-bound vendor rating rather than a demonstrated outcome; verify precise impact with Adobe APSB26-142. Net: prioritize patching for internet-exposed or multi-tenant ACC instances given PR:L + scope change, but the absence of exploitation, low automatability, and low EPSS mean this is targeted-risk, not wormable/opportunistic. |
| Exploit ScenarioDerived | A low-privileged authenticated user of an Adobe Campaign Classic instance submits a crafted request that causes the ACC server to make attacker-controlled outbound requests (SSRF), pivoting to internal resources and services not directly reachable by the attacker. Because scope is changed, the server-side request is leveraged to reach internal endpoints and escalate to elevated access beyond the attacker's original privilege boundary. No public exploit code is identified and no active exploitation is reported, so this remains a plausible-but-unproven chain based on the vendor description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 23, 2026
Server-side request forgery in Adobe Campaign Classic (Classic v7), affecting builds up to and including 7.4.4 build 9401, lets an authenticated low-privileged user coerce the ACC server into making requests to internal systems the user cannot reach directly, with the trust-boundary crossing reflected as a scope change (S:C) that can escalate that user's effective access. No user interaction is required, and Adobe rates the issue 9.9, while our independent assessment retains high confidentiality impact but lowers integrity and availability to Low (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and stresses that a valid low-privileged account is a prerequisite, so this is not remote-unauthenticated. No public exploit code and no CISA KEV entry have been identified at time of analysis, EPSS is low at 0.73% (53rd percentile), and SSVC marks the issue non-automatable with total technical impact - making the realistic risk targeted insider or post-foothold abuse rather than opportunistic internet-wide scanning.
Earlier versions of this analysis (1)
Server-side request forgery in Adobe Campaign Classic allows an authenticated attacker holding only a low-privileged account to make the ACC server issue requests to internal or otherwise unreachable resources, pivoting outside the application's own security boundary (scope change). Adobe rates the issue 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N); our independent assessment agrees on the network vector, low complexity, PR:L authentication requirement and scope change, but rates integrity impact lower (I:L) because the practical gain depends on what internal services are network-adjacent to the ACC instance - confidentiality exposure of those internal resources remains high. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so exploitation should be treated as feasible for a motivated authenticated insider or compromised low-privilege account rather than as a broadly exploited campaign. A valid authenticated ACC account is required - this is not an unauthenticated attack - and no user interaction is needed.
RemediationAI
Patch available per vendor advisory: consult Adobe APSB-26-142 (https://helpx.adobe.com/security/products/campaign/apsb26-142.html) for the minimum fixed build and upgrade any Adobe Campaign Classic v7 instance currently at or below 7.4.4 build 9401; the provided data does not specify an exact patched build number, so obtain that from the advisory rather than assuming one. Until the upgrade is validated, apply egress controls on the ACC server tier - the highest-value compensating control here, because the flaw requires the server to reach internal resources. Enforce a default-deny outbound allowlist covering only the specific hosts/ports ACC legitimately needs, and explicitly block link-local metadata endpoints such as 169.254.169.254 along with internal RFC1918 admin interfaces and management ports; the trade-off is that legitimate integrations, webhooks, and connector traffic to unlisted destinations will break and must be enumerated first. Restrict and audit low-privileged ACC accounts to shrink the PR:L population an attacker could use or create, and review which internal services are reachable from the ACC network segment (SSRF value drops sharply if that reachability is trimmed). Add logging/alerting on anomalous server-initiated requests to internal addresses, noting that detection is delayed rather than prevented. Because SSVC marks this non-automatable and no public exploit exists, these mitigations can be sequenced after higher-urgency work without accepting opportunistic mass-exploitation risk.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-918 (Server-Side Request Forgery): a user-supplied destination is processed by the ACC application server, which then initiates the outbound request itself, so the request originates from inside the trusted network zone rather than from the attacker. Adobe Campaign Classic v7 is a marketing-automation platform whose web-facing interfaces (client console and web endpoints) accept parameters that can drive server-side fetches, and because the fetch is performed by the ACC node, the attacker inherits that node's network position - the reason the CVSS vector carries S:C. The provided CPE, cpe:2.3:a:adobe:adobe_campaign_classic:*:*:*:*:*:*:*:*, is fully wildcarded, indicating that all ACC Classic builds in the affected branch, capped at 7.4.4 build 9401 per EUVD (EUVD-2026-84655), are in scope rather than a single edition. Authentication requirements are confirmed by the vector's PR:L: valid low-privileged credentials or application access are required, and UI:N means the attacker does not need to induce any victim action. Impact hinges on what the ACC server can itself reach - cloud instance metadata endpoints, internal admin interfaces, other backend systems, or internal APIs - since the attacker gains read/traversal capability for those services; our assessment therefore scores confidentiality as High while trimming integrity and availability to Low, reflecting that SSRF typically yields data exposure and internal pivoting rather than direct code execution or destructive writes on the ACC host.
Know when Adobe Campaign Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSRF from a low-priv account crossing an internal boundary (PR:L, S:C, C:H), but integrity/availability impact from SSRF is typically partial not total, so I:L/A:L rather than vendor's H.
Primary rating from Vendor (adobe).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
Executive ViewAI
Adobe Campaign Classic v7 (builds up to and including 7.4.4 build 9401) is affected by a critical server-side request forgery vulnerability (CVE-2026-82443) that allows an authenticated low-privileged user to coerce the server into making requests to internal systems, potentially bypassing network controls and escalating access. This poses a risk of data exposure or lateral movement, particularly from malicious insiders or attackers who have already compromised a low-privilege account, and leadership should care because the platform often handles sensitive customer data and connects to internal networks. While no public exploit identified at time of analysis and a valid low-privileged account is required, no vendor-released patch identified at time of analysis means organizations must rely on interim mitigations to protect critical assets.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting the ACC server's outbound network access through egress filtering or firewall rules, enforcing strict least privilege on ACC user accounts, and monitoring for unusual internal requests that could indicate exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Adobe Campaign Classic
View allArbitrary code execution in Adobe Campaign Classic, documented in Adobe security advisory APSB26-142, lets remote attack
Unauthenticated remote code execution in Adobe Campaign Classic lets any attacker who can reach the server run arbitrary
Unauthenticated remote code execution in Adobe Campaign Classic (ACC) allows a network-reachable attacker to execute arb
Unauthenticated remote code execution in Adobe Campaign Classic allows an attacker who can reach the application to exec
Remote, unauthenticated attackers can execute arbitrary code in the context of the current application user on systems r
Code injection in Adobe Campaign Classic allows remote attackers to execute arbitrary code in the context of the current
Remote code execution in Adobe Campaign Classic allows an unauthenticated network attacker to invoke functionality that
Arbitrary code execution in Adobe Campaign Classic (ACC) arises from OS command injection (CWE-78), letting an attacker
OS command injection in Adobe Campaign Classic (ACC) allows an attacker to execute arbitrary operating-system commands,
Server-side request forgery in Adobe Campaign Classic (versions up to and including 7.4.4 build 9401) lets remote unauth
Arbitrary code execution in Adobe Campaign Classic allows a low-privileged authenticated attacker to run code in the con
SQL injection in Adobe Campaign Classic (ACC) lets a remote, unauthenticated attacker inject arbitrary SQL commands that
Exploit-DB