CVE-2026-82013 in Campaign Classic
Summary
by MITRE • 09/22/2026
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
Adobe Campaign Classic contains a Server-Side Request Forgery vulnerability within its core processing logic, allowing an unauthenticated or low-privileged attacker to induce the server into making HTTP requests to arbitrary destinations controlled by the attacker. This flaw stems from insufficient validation of user-supplied input that is subsequently used as part of internal network communications. By manipulating these inputs, an adversary can craft malicious payloads that force the application backend to interact with internal services, metadata endpoints, or administrative interfaces that are not directly exposed to external networks but remain accessible within the local host or private subnet. The vulnerability does not require any user interaction for exploitation, as it can be triggered through automated requests targeting specific API endpoints or configuration parameters where input sanitization is inadequate.
The operational impact of this SSRF flaw extends beyond simple data exfiltration from internal services. Because Adobe Campaign Classic often runs with elevated system privileges to manage marketing workflows and database connections, the ability to make arbitrary network requests can be leveraged for privilege escalation. An attacker may exploit this capability to access cloud instance metadata services, such as those found on AWS or Azure environments, which frequently contain temporary security credentials and configuration details. Alternatively, the attacker could target internal management consoles, API gateways, or database administration tools that are bound only to localhost interfaces. Successful exploitation allows the adversary to bypass standard authentication mechanisms inherent in these internal resources, effectively gaining elevated access rights without needing valid user credentials for those specific services.
This vulnerability aligns with CWE-918, which defines Server-Side Request Forgery as a weakness where a web application retrieves data from a server specified by the user but fails to validate whether that request is intended or safe. From an offensive security perspective, this behavior maps directly to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle and Lateral Tool Transfer scenarios where SSRF is used as a pivot point for further network infiltration. The lack of user interaction requirement classifies the attack vector as Network-based with Low Complexity, significantly increasing its severity rating in standard vulnerability scoring systems like CVSS due to the ease of automated exploitation by remote attackers.
Mitigation strategies must focus on strict input validation and network segmentation principles. Administrators should ensure that Adobe Campaign Classic is configured to reject any requests containing IP addresses or hostnames that resolve to private address ranges, loopback interfaces, or cloud metadata endpoints unless explicitly required for legitimate business functions. Implementing a whitelist approach for allowed outbound connections can prevent the application from reaching unintended internal resources. Additionally, deploying network-level controls such as firewalls or reverse proxies with strict egress filtering rules can limit the blast radius of any successful SSRF attempt by blocking access to sensitive internal subnets. Regular patching to the latest version provided by Adobe is critical, as vendor updates typically include code fixes that enforce proper validation checks on all user-controlled inputs before they are processed in network requests.