CVE-2026-76193 Overview
CVE-2026-76193 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Adobe Campaign Classic (ACC). An attacker can exploit the flaw to execute arbitrary code in the context of the current user. The issue requires no user interaction and produces a scope change, meaning impact extends beyond the vulnerable component. Adobe published advisory APSB26-134 covering this issue.
Critical Impact
Unauthenticated attackers can trigger server-side requests that lead to arbitrary code execution, compromising confidentiality, integrity, and availability of the Campaign Classic environment.
Affected Products
- Adobe Campaign Classic (ACC)
- Refer to Adobe advisory APSB26-134 for the enumerated affected versions
- Deployments exposing ACC endpoints to untrusted networks
Discovery Timeline
- 2026-08-25 - CVE-2026-76193 published to the National Vulnerability Database (NVD)
- 2026-08-26 - Last updated in NVD database
- 2026-08-27 - EPSS scoring data recorded
Technical Details for CVE-2026-76193
Vulnerability Analysis
The flaw is a Server-Side Request Forgery weakness in Adobe Campaign Classic. ACC accepts a user-supplied URL or resource identifier and issues a server-initiated request without adequate validation of the destination. Because the vulnerability results in arbitrary code execution and changes scope, the initial SSRF primitive pivots into command execution on backend or adjacent components. Exploitation requires no authentication and no user interaction, and it can be performed over the network.
Root Cause
The root cause is missing or insufficient validation of URLs consumed by server-side fetch logic in ACC. The application follows attacker-controlled destinations, including internal endpoints, cloud metadata services, or protocol handlers that can be abused to reach code-execution sinks. Combined with scope change, the SSRF crosses trust boundaries between the web tier and privileged internal services.
Attack Vector
An attacker sends a crafted HTTP request to an ACC endpoint that accepts a URL, resource path, or callback parameter. The ACC server dereferences the attacker-controlled target and processes the response, which the attacker steers toward an internal service capable of executing code. The exploitation chain does not require credentials or user interaction.
No verified public exploit code is available. Refer to the Adobe Security Advisory APSB26-134 for technical guidance.
Detection Methods for CVE-2026-76193
Indicators of Compromise
- Outbound HTTP or HTTPS connections from ACC hosts to internal RFC1918 ranges, cloud metadata IPs such as 169.254.169.254, or localhost addresses.
- ACC web logs containing request parameters holding fully qualified URLs, IP literals, or non-HTTP schemes such as file://, gopher://, or dict://.
- Unexpected child processes spawned by the ACC application user following inbound HTTP requests.
Detection Strategies
- Inspect ACC access logs for anomalous URL-bearing parameters and requests originating from unauthenticated sources.
- Correlate inbound requests to ACC with subsequent outbound egress from the ACC host to atypical destinations.
- Baseline normal ACC egress traffic and alert on deviations, particularly connections to metadata services or internal admin interfaces.
Monitoring Recommendations
- Enable verbose HTTP client logging in ACC to capture destinations of server-initiated requests.
- Forward ACC application, web, and host telemetry to a centralized SIEM or data lake for correlation.
- Monitor process creation on ACC servers for shells, scripting interpreters, or download utilities executed by the ACC service account.
How to Mitigate CVE-2026-76193
Immediate Actions Required
- Apply the security update referenced in Adobe advisory APSB26-134 to all Adobe Campaign Classic instances.
- Restrict ACC server outbound network access to the minimum destinations required for operation.
- Block ACC egress to link-local, loopback, and internal management ranges at the network layer.
- Rotate credentials, API keys, and session tokens accessible from the ACC host if compromise is suspected.
Patch Information
Adobe has published fixes in security bulletin Adobe Security Advisory APSB26-134. Administrators should consult the advisory for the fixed versions and apply patches promptly. The vulnerability carries a maximum CVSS base score and an EPSS probability of 0.616% as of 2026-08-27.
Workarounds
- Place ACC behind a web application firewall with rules that reject URL, IP, and non-HTTP scheme values in unexpected parameters.
- Enforce an egress proxy allow-list for ACC servers, denying arbitrary outbound destinations.
- Restrict inbound access to ACC administrative and API endpoints to trusted networks pending patch deployment.
# Example iptables egress restriction for an ACC host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner acc -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner acc -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner acc -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
