Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

cve CVE-2026-82013 1 source, 1 claim · Watch

NVD writes:
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed. the claim

What it is to other things

affectsadobe/campaign
NVD
affectslinux/linux_kernel
NVD
affectsmicrosoft/windows
NVD
made_byadobe
NVD
made_bylinux
NVD
made_bymicrosoft
NVD

In words only, so not counted until a person confirms one:

affectsadobe/adobe_campaign_classic
NVD says “Adobe · Adobe Campaign Classic”

What each source says

PropertySourceSaidMeans here
Cvss
cvss
NVD9.9
receipt
Source
NVD
Its words
9.9
Read by
field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since
2026-09-29 09:45 UTC
Last answered
2026-10-03 00:06 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Adobe Campaign Classic",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "7.4.4 build 9401",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "7.4.4 build 9402",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*",
                "matchCriteriaId": "372C9136-435C-4501-9FB8-016600591108",
                "versionEndIncluding": "7.4.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9400:*:*:classic:*:*:*",
                "matchCriteriaId": "560799AF-A848-47B5-B37C-7B35C8D1B48B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9401:*:*:classic:*:*:*",
                "matchCriteriaId": "FA9301A1-69C2-470A-9520-E865A32B38BF",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
                "vulnerable": false
              },
              {
                "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed."
      }
    ],
    "id": "CVE-2026-82013",
    "lastModified": "2026-09-26T23:16:36.610",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.1,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-82013",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-26T22:38:13.914485Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T18:17:21.657",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/campaign/apsb26-142.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-918"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Product
product
NVDAdobe Campaign Classic
receipt
Source
NVD
Its words
Adobe Campaign Classic
Read by
field:cve.affected[].affectedData[].product
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-03 00:06 UTC
Original
open at the source
2026-09-29 17:49 UTCAdobe Campaign Classic
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Adobe Campaign Classic",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "7.4.4 build 9401",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "7.4.4 build 9402",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*",
                "matchCriteriaId": "372C9136-435C-4501-9FB8-016600591108",
                "versionEndIncluding": "7.4.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9400:*:*:classic:*:*:*",
                "matchCriteriaId": "560799AF-A848-47B5-B37C-7B35C8D1B48B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9401:*:*:classic:*:*:*",
                "matchCriteriaId": "FA9301A1-69C2-470A-9520-E865A32B38BF",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
                "vulnerable": false
              },
              {
                "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed."
      }
    ],
    "id": "CVE-2026-82013",
    "lastModified": "2026-09-26T23:16:36.610",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.1,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-82013",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-26T22:38:13.914485Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T18:17:21.657",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/campaign/apsb26-142.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-918"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-09-29 09:45 UTC
Last answered
2026-10-03 00:06 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Adobe Campaign Classic",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "7.4.4 build 9401",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "7.4.4 build 9402",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*",
                "matchCriteriaId": "372C9136-435C-4501-9FB8-016600591108",
                "versionEndIncluding": "7.4.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9400:*:*:classic:*:*:*",
                "matchCriteriaId": "560799AF-A848-47B5-B37C-7B35C8D1B48B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9401:*:*:classic:*:*:*",
                "matchCriteriaId": "FA9301A1-69C2-470A-9520-E865A32B38BF",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
                "vulnerable": false
              },
              {
                "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed."
      }
    ],
    "id": "CVE-2026-82013",
    "lastModified": "2026-09-26T23:16:36.610",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.1,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-82013",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-26T22:38:13.914485Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T18:17:21.657",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/campaign/apsb26-142.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-918"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDAdobe
receipt
Source
NVD
Its words
Adobe
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-03 00:06 UTC
Original
open at the source
2026-09-29 17:49 UTCAdobe
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Adobe Campaign Classic",
            "vendor": "Adobe",
            "versions": [
              {
                "lessThanOrEqual": "7.4.4 build 9401",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "status": "unaffected",
                "version": "7.4.4 build 9402",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "psirt@adobe.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:adobe:campaign:*:*:*:*:classic:*:*:*",
                "matchCriteriaId": "372C9136-435C-4501-9FB8-016600591108",
                "versionEndIncluding": "7.4.3",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9400:*:*:classic:*:*:*",
                "matchCriteriaId": "560799AF-A848-47B5-B37C-7B35C8D1B48B",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:adobe:campaign:7.4.4:9401:*:*:classic:*:*:*",
                "matchCriteriaId": "FA9301A1-69C2-470A-9520-E865A32B38BF",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          },
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
                "vulnerable": false
              },
              {
                "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
                "vulnerable": false
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ],
        "operator": "AND"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed."
      }
    ],
    "id": "CVE-2026-82013",
    "lastModified": "2026-09-26T23:16:36.610",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.1,
          "impactScore": 6.0,
          "source": "psirt@adobe.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-82013",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-09-26T22:38:13.914485Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-09-22T18:17:21.657",
    "references": [
      {
        "source": "psirt@adobe.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://helpx.adobe.com/security/products/campaign/apsb26-142.html"
      }
    ],
    "sourceIdentifier": "psirt@adobe.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-918"
          }
        ],
        "source": "psirt@adobe.com",
        "type": "Secondary"
      }
    ]
  }
}
—

vulnerability

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
zetlyn/cve-nvd · 2026-09-22
cvss 9.9 product Adobe Campaign Classic status Analyzed vendor Adobe source