Advisory · CVE-2026-83660
Unauthenticated SSRF in Adobe Campaign Classic enables privilege escalation
A server-side request forgery flaw in Adobe Campaign Classic can be exploited without authentication to escalate privileges against internal resources. CVSS 9.9.
- Vendor
- Adobe
- Product
- Adobe Campaign Classic
- Identifier / CWE
- CVE-2026-83660
CWE-918 - Action timing
- Immediate
Explain it like I’m five
A building directory kiosk answers questions from anyone on the street. Ask it about the internal phone system, and it dials those numbers for you from inside the building.
- 01No credentials
An unauthenticated attacker reaches the vulnerable Adobe Campaign Classic endpoint.
- 02Forged request
They make the server issue requests to attacker-chosen destinations.
- 03Internal reach
The server's requests touch internal resources from inside the trust boundary.
- 04Escalation
The attacker leverages that position for privilege escalation, with changed scope.
What happened
Adobe security bulletin APSB26-142 includes CVE-2026-83660, a server-side request forgery vulnerability (CWE-918) in Adobe Campaign Classic. Exploitation requires no privileges and no user interaction, and can result in privilege escalation via internal resources. Adobe Campaign Classic builds up to and including 7.4.4 build 9401; fixed in 7.4.4 build 9402. NVD rates it CVSS 9.9 (v3.1).
What to do
- Upgrade Adobe Campaign Classic to 7.4.4 build 9402 or later; this flaw needs no credentials, so prioritize internet-facing instances.
- Restrict outbound network access from Campaign servers.
- Review logs for unauthenticated requests that triggered outbound connections.
Management note
The unauthenticated variant of the Campaign SSRF is the sharper edge of the same bulletin: anyone on the internet can turn the Campaign server into an internal-network proxy. Internet-facing instances go first.