Adobe has disclosed a critical server-side request forgery flaw in Adobe Campaign Classic, scored CVSS 9.9, that lets a low-privileged attacker reach internal resources and escalate privileges without any user interaction.
What Is It
CVE-2026-82013 is a Server-Side Request Forgery vulnerability (CWE-918) in Adobe Campaign Classic (ACC). According to Adobe's advisory, the flaw "could result in privilege escalation," with a low-privileged attacker able to exploit it "to gain elevated access to internal resources." Exploitation does not require user interaction.
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base score 9.9, rated CRITICAL. The combination that drives the score: network-reachable, low attack complexity, only low privileges needed, no user interaction, and a changed scope with high impact to confidentiality, integrity, and availability.
Why It Matters
Scope is changed. That is the detail worth pausing on: the vulnerable component can be used to affect resources beyond its own security authority. An SSRF that crosses a trust boundary can turn an authenticated low-privilege foothold in the marketing platform into reach against internal systems the attacker was never meant to touch; with high confidentiality, integrity, and availability impact per Adobe's own scoring. How far that reach extends in practice will depend on how a given ACC instance is networked and segmented.
The exploitability subscore is 3.1 out of a possible 3.9, which suggests the barrier to exploitation is low for an attacker who already holds a valid low-privilege account.
What's Vulnerable
Per Adobe's affected-products data:
- Adobe Campaign Classic: all versions up to and including 7.4.4 build 9401 are affected.
- 7.4.4 build 9402 and later are listed as unaffected.
No CPE entries have been published for this CVE yet. NVD status is "Awaiting Analysis" as of 2026-09-22.
Patch Status
A fixed build exists: ACC 7.4.4 build 9402. Organizations running build 9401 or earlier should upgrade to build 9402 per Adobe's advisory APSB26-142.
As of 2026-09-22, CVE-2026-82013 does not appear in the CISA Known Exploited Vulnerabilities catalog, meaning there is no confirmed active exploitation on record and no BOD 22-01 remediation deadline for federal civilian agencies. That is the current state, not a guarantee; a 9.9 with a low privilege requirement in an internet-adjacent marketing platform is the kind of bug that attracts attention quickly.
Sources
- Adobe Security Bulletin APSB26-142; https://helpx.adobe.com/security/products/campaign/apsb26-142.html
- NVD, CVE-2026-82013, https://nvd.nist.gov/vuln/detail/CVE-2026-82013
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog