CVE-2026-48331 Overview
Adobe Campaign Classic (ACC) contains a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] that enables privilege escalation. The flaw allows unauthenticated attackers to coerce the server into issuing crafted requests to internal or external resources. Because the vulnerability scope is changed, exploitation impacts components beyond the vulnerable service itself.
Exploitation requires no user interaction and no prior authentication. Adobe published guidance in security advisory APSB26-120.
Critical Impact
A remote unauthenticated attacker can leverage SSRF in Adobe Campaign Classic to reach internal services, exfiltrate sensitive data, and escalate privileges across trust boundaries.
Affected Products
- Adobe Campaign Classic versions 7.4.3 builds 9394, 9396, 9397, and 9398
- Adobe Campaign Classic deployments on Linux
- Adobe Campaign Classic deployments on Microsoft Windows
Discovery Timeline
- 2026-08-03 - CVE-2026-48331 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-48331
Vulnerability Analysis
Adobe Campaign Classic accepts attacker-controlled input that influences the destination of server-issued HTTP requests. The application does not sufficiently validate or restrict the target URL before dispatching the request. As a result, the server can be directed to arbitrary internal endpoints, cloud metadata services, or administrative interfaces.
The SSRF condition changes vulnerability scope, meaning the compromised component can affect resources managed by a different security authority. Attackers use this to pivot from the network-facing Campaign service into privileged internal systems, retrieve session material, or interact with identity and provisioning APIs. The end result is privilege escalation within the marketing automation environment and connected infrastructure.
Root Cause
The defect is a missing or insufficient allowlist on URLs consumed by server-side HTTP client functionality in Adobe Campaign Classic. Without strict validation of scheme, host, and network destination, the application fetches attacker-supplied resources on behalf of the caller. Refer to the Adobe Security Advisory APSB26-120 for vendor-confirmed technical scope.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker submits a crafted request to an ACC endpoint that accepts a URL or hostname parameter. The Campaign server then issues the outbound request, returning response data or side effects to the attacker. Targets typically include cloud instance metadata endpoints, internal admin APIs, and trusted service accounts reachable from the ACC host.
No public proof-of-concept exploit is currently available. Consult the vendor advisory for detailed technical guidance.
Detection Methods for CVE-2026-48331
Indicators of Compromise
- Outbound HTTP requests from Adobe Campaign Classic hosts to internal RFC1918 addresses, 169.254.169.254, or non-business external destinations
- Unusual query strings or POST bodies to ACC endpoints containing URL-like parameters referencing localhost, loopback, or metadata hostnames
- New or unexpected authentication events for privileged accounts originating from the ACC application server
Detection Strategies
- Inspect ACC application and web server logs for parameters that carry URLs, IP literals, or encoded hostnames and correlate with subsequent outbound connections
- Baseline expected outbound destinations from ACC servers and alert on deviations, especially requests to cloud metadata IPs or internal management planes
- Monitor for privilege changes, new API tokens, or role modifications initiated by service accounts associated with ACC
Monitoring Recommendations
- Forward ACC web server, application, and host telemetry to a centralized analytics platform for retention and correlation
- Enable egress logging at the network layer and alert on any ACC host reaching sensitive internal subnets or cloud metadata endpoints
- Track process and network activity on ACC hosts to identify anomalous child processes or credential access following inbound HTTP requests
How to Mitigate CVE-2026-48331
Immediate Actions Required
- Apply the fixed version referenced in Adobe Security Advisory APSB26-120 to all Adobe Campaign Classic deployments
- Inventory ACC instances across Linux and Windows hosts and prioritize internet-exposed systems first
- Rotate credentials, API keys, and tokens accessible from the ACC application server after patching
Patch Information
Adobe released remediation in advisory APSB26-120. Administrators should upgrade Adobe Campaign Classic beyond the vulnerable 7.4.3 builds (9394, 9396, 9397, 9398) to the fixed release identified by Adobe. Verify the installed build post-upgrade and confirm the fix on both application servers and any redundant nodes.
Workarounds
- Restrict egress traffic from ACC servers using host firewalls or network policies, blocking access to cloud metadata endpoints and internal management interfaces
- Place ACC behind a reverse proxy or web application firewall that inspects and filters URL-bearing parameters
- Disable or restrict access to ACC features that accept externally supplied URLs until the patch is applied
# Example egress restriction on Linux ACC hosts using iptables
# Block outbound access to AWS/GCP/Azure instance metadata endpoint
iptables -A OUTPUT -d 169.254.169.254 -j DROP
# Restrict outbound HTTP/HTTPS to an approved proxy only
iptables -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner proxy -j DROP
iptables -A OUTPUT -p tcp --dport 443 -m owner ! --uid-owner proxy -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
