CVE-2026-83660: Adobe Campaign Classic SSRF Vulnerability

CVE-2026-83660 Overview

Adobe Campaign Classic (ACC) contains a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] that enables privilege escalation. The flaw carries a maximum CVSS score and requires no authentication or user interaction. An unauthenticated network attacker can coerce the server into issuing crafted requests to internal or external resources. Because the CVSS scope is changed, the impact extends beyond the vulnerable component to other security domains.

Adobe published advisory APSB26-142 addressing the issue. Confirmed affected builds include Adobe Campaign Classic versions 7.4.4:9400 and 7.4.4:9401 on both Linux and Windows deployments.

Critical Impact
An unauthenticated attacker can trigger SSRF from Adobe Campaign Classic to escalate privileges, with confidentiality, integrity, and availability all fully impacted across a changed scope.

Affected Products

Adobe Campaign Classic version 7.4.4:9400
Adobe Campaign Classic version 7.4.4:9401
Adobe Campaign Classic deployments on Linux and Microsoft Windows

Discovery Timeline

2026-09-22 - CVE-2026-83660 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-83660

Vulnerability Analysis

Adobe Campaign Classic is an enterprise cross-channel marketing platform that manages customer data, campaigns, and messaging. The vulnerability allows a remote unauthenticated attacker to induce the ACC server to make HTTP or protocol-level requests to attacker-chosen destinations. This SSRF condition can be leveraged to reach internal services normally unreachable from outside the perimeter.

The changed scope indicates the exploited component can act on resources controlled by a different security authority. In practical terms, the SSRF pivot can be chained into privilege escalation by contacting internal management interfaces, cloud metadata endpoints, or authenticated back-end services that trust the campaign server.

Adobe's advisory APSB26-142 is the authoritative reference for exploitation prerequisites and fixed builds.

Root Cause

The root cause is insufficient validation of user-supplied URLs or request destinations processed by the ACC server, classified under [CWE-918] Server-Side Request Forgery. The application accepts input that controls the target of an outbound request without enforcing an allowlist or restricting internal address ranges.

Attack Vector

Exploitation occurs over the network against an exposed Adobe Campaign Classic instance. No credentials are required, and no user interaction is involved. An attacker submits a crafted request containing a URL that the server dereferences. The response, error behavior, or side effects of that internal request can be abused to enumerate infrastructure, obtain credentials from metadata services, or invoke privileged administrative endpoints. As of publication, no public proof-of-concept or exploit code has been observed, and the EPSS probability is low.

See the Adobe Security Advisory APSB26-142 for technical remediation details.

Detection Methods for CVE-2026-83660

Indicators of Compromise

Outbound HTTP or HTTPS connections from the Adobe Campaign Classic server to internal RFC1918 addresses, cloud metadata IPs such as 169.254.169.254, or loopback interfaces.
Unexpected authentication events or configuration changes correlated with inbound requests to ACC web endpoints.
Anomalous entries in ACC application logs showing URL parameters pointing to non-standard schemes or hosts.

Detection Strategies

Inspect web application and reverse proxy logs for request parameters containing full URLs, IP literals, or protocol handlers such as file://, gopher://, or dict://.
Correlate outbound network flows from the ACC host against a baseline of expected marketing and delivery endpoints.
Alert on ACC service processes initiating connections to cloud instance metadata endpoints or internal admin interfaces.

Monitoring Recommendations

Enable verbose logging on the ACC application tier and forward events to a centralized analytics platform for correlation.
Deploy egress filtering and log denied outbound connections originating from the ACC server subnet.
Monitor for privilege escalation indicators such as new administrative accounts or role changes in ACC following inbound web traffic bursts.

How to Mitigate CVE-2026-83660

Immediate Actions Required

Apply the vendor updates referenced in Adobe Security Advisory APSB26-142 to all Adobe Campaign Classic instances, prioritizing internet-facing deployments.
Inventory ACC versions across Linux and Windows hosts and confirm builds 7.4.4:9400 and 7.4.4:9401 are remediated.
Restrict network exposure of ACC administrative and API endpoints to trusted management networks until patching is complete.

Patch Information

Adobe released fixed builds for Adobe Campaign Classic in advisory APSB26-142. Administrators should follow the vendor's guidance for the specific ACC deployment topology, including operator server, marketing server, and mid-sourcing components. Validate the patched version after deployment and restart dependent services.

Workarounds

Enforce strict egress filtering from the ACC server so it can reach only required external delivery and tracking endpoints.
Block outbound access from the ACC host to cloud metadata addresses such as 169.254.169.254 and to internal management subnets.
Place a web application firewall in front of ACC to reject requests containing URL parameters that reference internal address ranges or unusual URI schemes.
Rotate any credentials, API keys, or cloud instance role tokens accessible from the ACC host if compromise is suspected.

bash

# Example egress restriction using iptables on the ACC host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 8080 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP