Adobe disclosed a critical Server-Side Request Forgery flaw in Adobe Campaign Classic that can lead to arbitrary code execution without user interaction, carrying a maximum CVSS 3.1 base score of 10.0.
What Is It
CVE-2026-76193 is a Server-Side Request Forgery vulnerability (CWE-918) in Adobe Campaign Classic (ACC). Per Adobe's PSIRT advisory, the flaw "could result in arbitrary code execution in the context of the current user." Exploitation does not require user interaction, and the scope is changed, meaning the impact extends beyond the vulnerable component's own security boundary.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, yielding a base score of 10.0 (CRITICAL). That combination of network-reachable, low complexity, no privileges, no user interaction, changed scope, and high confidentiality, integrity, and availability impact is the worst-case profile a CVSS 3.1 score can express.
Why It Matters
An unauthenticated attacker with network access can reach this bug directly, with no victim required to click anything. The exploitability subscore is 3.9, the maximum. Adobe Campaign Classic is a marketing automation platform that typically holds large volumes of customer contact and campaign data, and its servers frequently sit at the boundary between internet-facing delivery infrastructure and internal networks, the exact position where SSRF is most damaging.
There is no CISA KEV entry for CVE-2026-76193 in the supplied source material, so active exploitation has not been confirmed by KEV at this time.
What's Vulnerable
- Adobe Campaign Classic (ACC) v7: all versions up to and including 7.4.4 build 9400 are affected.
- ACC v7 7.4.4 build 9401 is listed as unaffected.
No CPE match data was published with the NVD record at time of writing. The CVE was published and last modified on 2026-08-25 and remains in NVD status "Received," meaning NVD analysis is not yet complete.
Patch Status
Adobe has shipped a fix. Upgrading to ACC v7 7.4.4 build 9401 or later moves systems onto the version Adobe marks as unaffected. Given a 10.0 score against a network-exposed marketing platform, patching should not wait on a routine maintenance window. Consult Adobe security bulletin APSB26-134 for full remediation guidance. No specific required-action deadline or mitigation guidance beyond the version update is present in the supplied source data.
Sources
- NVD, CVE-2026-76193: https://nvd.nist.gov/vuln/detail/CVE-2026-76193
- Adobe PSIRT Security Bulletin APSB26-134: https://helpx-internal.corp.adobe.com/content/help/en/security/products/campaign/apsb26-134.html