CVE-2026-76193 in Campaign Classic
Summary
by MITRE • 08/25/2026
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/25/2026
Adobe Campaign Classic contains a Server-Side Request Forgery vulnerability within its core processing logic, which allows an unauthenticated or authenticated remote attacker to induce the application server to make HTTP requests to arbitrary destinations under the control of the attacker. This flaw stems from insufficient validation and sanitization of user-supplied input that is subsequently used as part of outbound network connections initiated by the backend service. By manipulating these inputs, a malicious actor can craft specific payloads designed to bypass internal security controls, effectively tricking the Adobe Campaign Classic server into acting as an open proxy or executing requests against internal infrastructure components that are not directly accessible from external networks. The vulnerability is particularly severe because it does not require any user interaction for exploitation; an attacker can trigger the condition simply by sending a specially crafted request to the affected service endpoints, leveraging the trust relationship between the application and its underlying network environment.
The operational impact of this SSRF flaw extends beyond mere data exfiltration or internal network reconnaissance, as it directly facilitates arbitrary code execution in the context of the current user running the Adobe Campaign Classic process. When the server processes a maliciously crafted request that targets an internal service with known vulnerabilities or misconfigurations, such as an administrative interface or a debug endpoint, the attacker can inject commands or exploit existing weaknesses within those downstream services. Because the requests originate from the application server itself, they often bypass perimeter firewalls and intrusion detection systems that rely on source IP reputation. This capability allows the attacker to pivot through the network architecture with significant stealth, potentially accessing sensitive internal resources like database servers, configuration management tools, or other microservices that handle critical business logic. The change in scope indicates that this vulnerability is now recognized as a direct pathway to full system compromise rather than just information disclosure, elevating its severity rating significantly within risk assessment frameworks.
From a technical classification perspective, this issue aligns with CWE-918, which defines Server-Side Request Forgery (SSRF) flaws where the server makes requests based on user input without proper validation of the destination URL or IP address. The exploitation technique maps to MITRE ATT&CK tactic T1557, specifically subtechnique T1557.002 for Adversary-in-the-Middle scenarios if used to intercept traffic, but more accurately reflects T1648 Supply Chain Compromise if the SSRF is leveraged to compromise trusted third-party services or internal dependencies that feed into the application's data pipeline. Furthermore, the resulting arbitrary code execution falls under CWE-94 Improper Control of Generation of Code (Code Injection) and MIT&CK technique T1059 Command and Scripting Interpreter, as the attacker gains the ability to execute system-level commands through the compromised service context. The lack of user interaction requirement places this vulnerability in a high-risk category for automated exploitation tools commonly found in threat actor arsenals, allowing for rapid propagation across vulnerable instances without social engineering prerequisites.
Mitigation strategies must focus on immediate network segmentation and strict input validation protocols. Administrators should implement egress filtering rules at the firewall or proxy level to restrict outbound connections from Adobe Campaign Classic servers to only those domains and IP addresses that are explicitly required for business operations, thereby blocking access to internal management interfaces and cloud metadata services commonly targeted in SSRF attacks. Additionally, deploying a Web Application Firewall with specific signatures for SSRF patterns can provide an additional layer of defense by inspecting outgoing traffic for anomalies such as requests targeting private IP ranges or non-standard ports. On the application side, developers must enforce strict allow-lists for any URL parsing functions and ensure that all user-controlled inputs are sanitized before being passed to network libraries. Regular patching is critical; organizations should apply the latest security updates provided by Adobe immediately to address this flaw at its source, as relying solely on perimeter defenses may not be sufficient against sophisticated attackers who can bypass basic filtering mechanisms through encoded or obfuscated payloads.