CVE-2026-82443 — Campaign
CRITICALCVE-2026-82443 is a critical-severity (CVSS 9.6) Server-Side Request Forgery (SSRF) vulnerability in adobe campaign. No vendor fix is recorded yet; mitigation options are listed below.
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this…
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-82443.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-82443 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 386,684 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Description
Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.
Affected Products
campaignadobeDetection & mitigation playbook
Vendor / applianceDetect
Inventory every adobe campaign deployment and check each version against the affected-products list above.
Remediation status
No patch has shipped for CVE-2026-82443 yet — track the adobe campaign advisory for a fixed release and apply the workarounds below in the meantime.
Mitigate without a patch
Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.
Frequently Asked Questions
Is CVE-2026-82443 being exploited in your environment?
Detect and block the exploit chain at execution, on systems you cannot patch yet.