CVE-2026-83660 in Campaign Classic
Summary
by MITRE • 09/22/2026
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The identified vulnerability within Adobe Campaign Classic represents a critical security flaw classified as a Server-Side Request Forgery, which fundamentally allows an attacker to induce the server-side application to make HTTP requests to arbitrary destinations under circumstances where such access should be restricted. This specific instance of SSRF is particularly dangerous because it facilitates privilege escalation, meaning that exploitation by an unauthenticated or low-privileged user can lead to gaining higher levels of system authority, potentially equivalent to administrative privileges. The absence of a requirement for user interaction significantly lowers the barrier to entry for attackers, allowing for automated, remote exploitation without the need for social engineering tactics such as phishing links or malicious file uploads that require manual clicking by a victim. This characteristic transforms the vulnerability from a potential risk into an immediate and severe threat vector capable of being exploited at scale against vulnerable instances.
From a technical perspective, SSRF vulnerabilities typically arise when a web application fetches a remote resource without validating the user-supplied URL or IP address provided as input. In the context of Adobe Campaign Classic, this likely involves components that process external data to retrieve content, integrate with third-party services, or perform backend operations where the destination endpoint is derived from user-controlled parameters. By manipulating these inputs, an attacker can direct the server to communicate with internal network resources that are otherwise inaccessible from the public internet, such as metadata service endpoints on cloud infrastructure, internal database ports, or administrative interfaces of other systems within the same network segment. The ability to change the scope indicates that the vulnerability affects not just local file access but potentially extends to broader network interactions, amplifying the potential blast radius of a successful exploit.
The operational impact of this vulnerability is severe due to its role as an enabler for privilege escalation. Once an attacker successfully leverages the SSRF flaw to interact with internal services or sensitive backend components, they can often extract authentication tokens, session cookies, or configuration data that reveal credentials for higher-privileged accounts. This effectively bypasses standard access control mechanisms and allows the attacker to assume the identity of administrators or system users. The consequences include unauthorized modification of campaign configurations, theft of customer data stored within the platform, disruption of marketing operations through deletion or alteration of workflows, and potentially using the compromised server as a pivot point for further attacks against other systems in the enterprise network. Given that Adobe Campaign Classic is often central to an organization's digital marketing infrastructure, such a breach can lead to significant reputational damage and regulatory penalties under data protection laws like GDPR or CCPA due to the exposure of personally identifiable information.
To mitigate this risk, organizations must implement strict input validation on all parameters that are used to construct URLs or initiate network connections within Adobe Campaign Classic. This includes enforcing allowlists for permitted domains and IP addresses while blocking requests to private RFC 1918 address ranges, link-local addresses, and cloud metadata endpoints such as those found at 169.254.169.254. Network-level controls should also be employed, including the use of firewalls or proxy servers that restrict outbound connections from the application server to only necessary external destinations. Additionally, applying the latest security patches provided by Adobe is critical, as vendors typically release updates specifically designed to address SSRF flaws through code hardening and enhanced validation logic. Security teams should also monitor for unusual outbound traffic patterns originating from the Campaign Classic server and ensure that least-privilege principles are enforced on all service accounts associated with the application to limit the potential impact of any successful exploitation attempt. This vulnerability aligns with CWE-918, which covers Server-Side Request Forgery, and its exploitation pattern often correlates with ATT&CK techniques related to Discovery and Lateral Movement, emphasizing the need for comprehensive network segmentation and continuous monitoring strategies.