CVE-2026-83660

Adobe Campaign Classic (ACC) contains a server-side request forgery (SSRF) vulnerability, tracked as CVE-2026-83660, that allows an attacker to make the server issue requests to internal or otherwise unreachable resources. Exploitation requires no authentication, no privileges, and no user interaction, and the 'scope changed' metric means the impact extends beyond the vulnerable component itself. Successful exploitation can escalate privileges on the underlying system, with high impact on confidentiality and limited impact on integrity and availability, earning a CVSS 3.1 score of 9.9 (critical). Organizations running Adobe Campaign Classic deployments, whether on-premises or Adobe-hosted, are the affected population. There is no evidence of exploitation in the wild, no public proof of concept, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.

What to do: Apply Adobe's patched build for Adobe Campaign Classic as specified in the relevant Adobe security bulletin (APSByy-nn), since exact fixed versions were not included in this data. Restrict internet-facing access to Campaign web/application server endpoints (e.g., the nlserver web modules) to trusted IPs and VPN clients, and enforce egress filtering so the Campaign servers cannot reach internal metadata services, admin interfaces, or other internal-only resources. Review server logs for unexpected outbound requests originating from the Campaign instance as an indicator of attempted SSRF.