CVE-2026-82443 is a critical (9.6) server-side request forgery flaw in Adobe Campaign Classic. A low-privileged attacker could gain elevated access to internal resources, with no user interaction and a changed scope. Adobe's bulletin APSB26-142 gives the fixed build, so apply that update.
What's affected
The record lists Adobe Campaign Classic (ACC) on Windows and Linux, and points to Adobe security bulletin APSB26-142. My attempt to load the bulletin was blocked, so I cannot state the affected and fixed build numbers here. Read APSB26-142 for the exact versions and the update you need.
The record does not give version numbers, so do not rely on this post for them. Adobe publishes the fixed build in its bulletin.
How to check if you're exposed
Find your Campaign Classic servers and their build number. In the Campaign Classic client, the version appears in the Help menu under About. Compare it to the fixed build in APSB26-142.
Also check who can reach the server. The record says exploitation needs no user interaction and the scope is changed, which means the effect can reach beyond the Campaign component itself.
What to do now
- Inventory every Adobe Campaign Classic instance, including staging and test.
- Read Adobe bulletin APSB26-142 for the fixed build and Adobe's priority rating.
- Apply the update on all servers, following Adobe's upgrade steps.
- Limit network access to Campaign Classic servers to the users and systems that need it.
- Review database and server logs for activity you cannot explain, since the record involves database and internal resource access.
Why it matters
The weakness is CWE-918, server-side request forgery. The server can be made to send requests on the attacker's behalf, from a position inside your network where internal services trust it.
That is why the scope is marked as changed. The impact lands on systems other than Campaign itself, such as internal APIs and cloud metadata endpoints in typical SSRF cases. Adobe does not publish those details here, so check the bulletin. The record is not listed in CISA's KEV catalog.
Quick check
What does SSRF let an attacker reach?
Whatever the vulnerable server can reach and others cannot, such as internal services. The record says internal resources and elevated access.
Sources
Last reviewed: 19 October 2026.
