Advisory · CVE-2026-82013
SSRF in Adobe Campaign Classic enables privilege escalation
A server-side request forgery flaw in Adobe Campaign Classic lets a low-privileged attacker reach internal resources and escalate privileges. CVSS 9.9.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-82013
CWE-918 - Action timing
- Immediate
Explain it like I’m five
A receptionist will call any internal extension you ask for and read back the answer. An attacker asks for the extension of the vault, and the receptionist happily connects them.
- 01Low-privileged access
An attacker holds a low-privileged account on Adobe Campaign Classic.
- 02Forged request
They make the server issue requests to attacker-chosen destinations.
- 03Internal reach
The server's requests reach internal resources the attacker cannot touch directly.
- 04Escalation
Access to those internal resources yields elevated privileges, with changed scope.
What happened
Adobe security bulletin APSB26-142 includes CVE-2026-82013, a server-side request forgery vulnerability (CWE-918) in Adobe Campaign Classic. A low-privileged attacker can exploit it without user interaction to gain elevated access to internal resources. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 9.9 (v3.1).
What to do
- Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later.
- Restrict outbound network access from Campaign servers to the minimum required.
- Review logs for server-initiated requests to unexpected internal hosts.
Management note
SSRF in a server that sits near marketing data pipelines is a pivot point into the internal network. Egress filtering on Campaign hosts is the durable defense beyond this patch.