High priorityDisclosed

Advisory · CVE-2026-82013

SSRF in Adobe Campaign Classic enables privilege escalation

A server-side request forgery flaw in Adobe Campaign Classic lets a low-privileged attacker reach internal resources and escalate privileges. CVSS 9.9.

Vendor
Adobe
Product
Adobe Campaign Classic
Identifier / CWE
CVE-2026-82013
CWE-918
Action timing
Immediate
ELI5

Explain it like I’m five

A receptionist will call any internal extension you ask for and read back the answer. An attacker asks for the extension of the vault, and the receptionist happily connects them.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Low-privileged access

    An attacker holds a low-privileged account on Adobe Campaign Classic.

  2. 02Forged request

    They make the server issue requests to attacker-chosen destinations.

  3. 03Internal reach

    The server's requests reach internal resources the attacker cannot touch directly.

  4. 04Escalation

    Access to those internal resources yields elevated privileges, with changed scope.

What happened

Adobe security bulletin APSB26-142 includes CVE-2026-82013, a server-side request forgery vulnerability (CWE-918) in Adobe Campaign Classic. A low-privileged attacker can exploit it without user interaction to gain elevated access to internal resources. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 9.9 (v3.1).

What to do

  1. Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later.
  2. Restrict outbound network access from Campaign servers to the minimum required.
  3. Review logs for server-initiated requests to unexpected internal hosts.

Management note

SSRF in a server that sits near marketing data pipelines is a pivot point into the internal network. Egress filtering on Campaign hosts is the durable defense beyond this patch.