CVE-2026-82443: Adobe Campaign Classic SSRF Vulnerability

CVE-2026-82443 Overview

Adobe Campaign Classic (ACC) contains a Server-Side Request Forgery (SSRF) vulnerability that allows low-privileged attackers to escalate privileges and access internal resources. The flaw, tracked as CVE-2026-82443, affects the classic edition of Adobe Campaign, including versions 7.4.4:9400 and 7.4.4:9401. Exploitation requires network access and low-level authentication but no user interaction. The scope is changed, meaning the vulnerability impacts components beyond the vulnerable process itself. Adobe has published security advisory APSB26-142 addressing the issue.

Critical Impact
A low-privileged attacker can send crafted requests through the Adobe Campaign Classic server to reach internal resources, resulting in privilege escalation and full compromise of confidentiality, integrity, and availability across trust boundaries.

Affected Products

Adobe Campaign Classic (all versions matching the affected CPE ranges)
Adobe Campaign Classic 7.4.4:9400
Adobe Campaign Classic 7.4.4:9401 on Linux and Microsoft Windows platforms

Discovery Timeline

2026-09-22 - CVE-2026-82443 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-82443

Vulnerability Analysis

CVE-2026-82443 is a Server-Side Request Forgery (SSRF) weakness classified under [CWE-918]. The vulnerable Adobe Campaign Classic server accepts user-influenced URLs or request parameters and issues outbound requests without sufficient validation of the target destination. Because the request originates from the trusted server context, the attacker can reach systems and services that are otherwise unreachable from the public network.

The changed scope indicates that the vulnerable component and the impacted component reside in different security authorities. In practice, an authenticated marketing operator with limited application rights can pivot to internal management interfaces, cloud metadata endpoints, or backend services that trust the Campaign server. This pivot yields privilege escalation without additional exploitation primitives.

Root Cause

The root cause is missing or insufficient validation of URLs, hostnames, or IP addresses supplied to server-side request-issuing functionality within Adobe Campaign Classic. The server does not enforce an allowlist of destinations or block access to loopback, link-local, and private IP ranges before dispatching the request.

Attack Vector

An attacker authenticates to Adobe Campaign Classic with any low-privileged account and submits a crafted request containing a URL pointing to an internal resource. The Campaign server retrieves the target and returns response content, headers, or side-channel signals to the attacker. Targets commonly include cloud instance metadata services, internal REST APIs, administrative dashboards bound to localhost, and adjacent internal hosts.

No verified public proof-of-concept code is available for CVE-2026-82443. Refer to the Adobe Campaign Security Advisory APSB26-142 for authoritative technical details.

Detection Methods for CVE-2026-82443

Indicators of Compromise

Outbound HTTP or HTTPS requests originating from the Adobe Campaign Classic server process to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 127.0.0.1.
Requests from the Campaign server to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Unexpected authentication or API calls to internal services sourced from the Campaign server IP address.

Detection Strategies

Inspect Adobe Campaign application logs for parameters containing URLs, hostnames, or IP addresses submitted by low-privileged users.
Correlate low-privileged user session activity with outbound network connections from the Campaign server to non-standard internal destinations.
Deploy web application firewall rules that flag request parameters carrying IP literals or unusual URL schemes such as file://, gopher://, or dict://.

Monitoring Recommendations

Baseline normal egress destinations from Adobe Campaign servers and alert on deviations, especially connections to metadata services or private ranges.
Enable verbose audit logging on Campaign workflow and delivery components that accept external URLs.
Forward Campaign server network telemetry to a centralized analytics platform for retention and correlation with identity events.

How to Mitigate CVE-2026-82443

Immediate Actions Required

Apply the security update referenced in Adobe advisory APSB26-142 to all Adobe Campaign Classic instances.
Audit accounts with low-privileged access to Adobe Campaign and revoke unused or stale credentials.
Restrict outbound network access from Campaign servers to only the destinations required for legitimate operation.

Patch Information

Adobe has released fixed builds for Adobe Campaign Classic. See the Adobe Campaign Security Advisory APSB26-142 for the corrected version numbers and download locations. Prioritize upgrading systems running 7.4.4:9400 and 7.4.4:9401.

Workarounds

Place Adobe Campaign Classic servers behind an egress proxy that enforces a strict destination allowlist.
Block access from Campaign servers to cloud instance metadata endpoints such as 169.254.169.254 using host firewall rules.
Disable or restrict Campaign features that fetch remote content on behalf of authenticated users where operationally feasible.

bash

# Configuration example: block SSRF pivots to metadata and private ranges from the Campaign host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner nlserver -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner nlserver -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner nlserver -j DROP