High priorityDisclosed

Advisory · CVE-2026-83660

Unauthenticated SSRF in Adobe Campaign Classic enables privilege escalation

A server-side request forgery flaw in Adobe Campaign Classic can be exploited without authentication to escalate privileges against internal resources. CVSS 9.9.

Vendor
Adobe
Product
Adobe Campaign Classic
Identifier / CWE
CVE-2026-83660
CWE-918
Action timing
Immediate
ELI5

Explain it like I’m five

A building directory kiosk answers questions from anyone on the street. Ask it about the internal phone system, and it dials those numbers for you from inside the building.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01No credentials

    An unauthenticated attacker reaches the vulnerable Adobe Campaign Classic endpoint.

  2. 02Forged request

    They make the server issue requests to attacker-chosen destinations.

  3. 03Internal reach

    The server's requests touch internal resources from inside the trust boundary.

  4. 04Escalation

    The attacker leverages that position for privilege escalation, with changed scope.

What happened

Adobe security bulletin APSB26-142 includes CVE-2026-83660, a server-side request forgery vulnerability (CWE-918) in Adobe Campaign Classic. Exploitation requires no privileges and no user interaction, and can result in privilege escalation via internal resources. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 9.9 (v3.1).

What to do

  1. Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later; this flaw needs no credentials, so prioritize internet-facing instances.
  2. Restrict outbound network access from Campaign servers.
  3. Review logs for unauthenticated requests that triggered outbound connections.

Management note

The unauthenticated variant of the Campaign SSRF is the sharper edge of the same bulletin: anyone on the internet can turn the Campaign server into an internal-network proxy. Internet-facing instances go first.