CVE-2026-82013: Adobe Campaign Classic SSRF Vulnerability

CVE-2026-82013 is a server-side request forgery flaw in Adobe Campaign Classic enabling privilege escalation attacks. Low-privileged attackers can exploit this to access internal resources without user interaction. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-82013 Overview

Adobe Campaign Classic (ACC) contains a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] that enables privilege escalation. A low-privileged attacker can send crafted requests that force the ACC server to interact with internal resources on the attacker's behalf. Successful exploitation grants elevated access to backend systems the attacker cannot reach directly. The flaw requires no user interaction and results in a scope change, meaning impact extends beyond the vulnerable component. Adobe assigned this issue to advisory APSB26-142 and confirmed impact against ACC versions 7.4.4:9400 and 7.4.4:9401.

Critical Impact
A low-privileged network attacker can pivot through Adobe Campaign Classic to internal services, achieving high impact to confidentiality, integrity, and availability across the affected trust boundary.

Affected Products

Adobe Campaign Classic version 7.4.4:9400
Adobe Campaign Classic version 7.4.4:9401
Adobe Campaign Classic deployments on Linux and Microsoft Windows hosts

Discovery Timeline

2026-09-22 - CVE-2026-82013 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-82013

Vulnerability Analysis

Adobe Campaign Classic accepts a URL or resource identifier from an authenticated low-privileged user and issues a server-side request without validating the destination. Because the request originates from the ACC server, it inherits the trust context of the application and its host. The attacker uses this behavior to reach internal endpoints, cloud metadata services, or administrative interfaces that are otherwise unreachable from external networks.

The scope change indicates that the SSRF crosses a security boundary. An attacker with basic ACC access can influence resources controlled by a different authority, such as adjacent services on the internal network or identity endpoints backing the ACC deployment. Privilege escalation follows when the attacker retrieves credentials, tokens, or configuration data from those internal targets.

Root Cause

The root cause is missing or insufficient validation of user-supplied URLs before the server initiates outbound HTTP requests. Adobe's advisory categorizes the issue under CWE-918: Server-Side Request Forgery. ACC does not enforce an allowlist of destination hosts or block requests to loopback, link-local, and private IP ranges.

Attack Vector

Exploitation requires network access to an ACC instance and a low-privileged account. The attacker submits a request containing a controlled destination URL. ACC dispatches the request and returns response data, headers, or timing signals to the attacker. Common SSRF targets include 169.254.169.254 cloud metadata endpoints, internal REST APIs, and management consoles bound to 127.0.0.1. Refer to the Adobe Security Update APSB26-142 for vendor-provided technical context.

Detection Methods for CVE-2026-82013

Indicators of Compromise

Outbound HTTP requests from the ACC application server to internal RFC1918 ranges, 127.0.0.0/8, or 169.254.0.0/16 that do not match documented integration patterns.
Application logs showing low-privileged user sessions triggering URL-fetching functionality against non-standard hosts or ports.
Unexpected DNS lookups originating from the ACC host for cloud metadata hostnames or internal service names.

Detection Strategies

Baseline the normal set of outbound destinations for the ACC service account and alert on deviations.
Correlate ACC user authentication events with subsequent outbound network connections initiated by the ACC process.
Inspect ACC HTTP request parameters for URL schemes such as file://, gopher://, or private IP literals submitted by non-administrative users.

Monitoring Recommendations

Forward ACC application logs and host process telemetry to a centralized analytics platform for correlation with network flow data.
Enable egress logging on the ACC subnet and review requests targeting metadata services or internal management endpoints.
Track privilege changes and new API token issuance in systems adjacent to ACC, since these are common post-SSRF actions.

How to Mitigate CVE-2026-82013

Immediate Actions Required

Apply the fixed release referenced in Adobe Security Advisory APSB26-142 to all ACC 7.4.4 instances.
Restrict egress from ACC servers using host-based or network firewalls, blocking access to metadata IPs and internal management ranges.
Rotate credentials, API keys, and service tokens accessible from the ACC host if exploitation cannot be ruled out.

Patch Information

Adobe published fixes in advisory APSB26-142. Administrators should identify all ACC Classic deployments, confirm the running build against 7.4.4:9400 and 7.4.4:9401, and upgrade to the vendor-designated fixed version. Coordinate maintenance windows with Adobe support if the deployment uses custom workflows or connectors.

Workarounds

Enforce network segmentation that prevents the ACC server from initiating connections to sensitive internal subnets and cloud metadata endpoints.
Configure an outbound proxy with a strict destination allowlist for the ACC service account until patching is complete.
Reduce the number of low-privileged accounts with access to URL-handling ACC features and audit their activity daily.