CVE-2026-83660 is a critical (9.9) server-side request forgery flaw in Adobe Campaign Classic that could lead to privilege escalation. The vector lists no privileges required, no user interaction and a changed scope. Adobe's bulletin APSB26-142 names the fixed build, so treat this one as the first to patch of the three.
What's affected
The record lists Adobe Campaign Classic (ACC) on Windows and Linux, and points to Adobe security bulletin APSB26-142. My attempt to load the bulletin was blocked, so I cannot state the affected and fixed build numbers here. Read APSB26-142 for the exact versions and the update you need.
The record does not give version numbers, so do not rely on this post for them. Adobe publishes the fixed build in its bulletin.
How to check if you're exposed
Find your Campaign Classic servers and their build number. In the Campaign Classic client, the version appears in the Help menu under About. Compare it to the fixed build in APSB26-142.
Also check who can reach the server. The record says exploitation needs no user interaction and the scope is changed, which means the effect can reach beyond the Campaign component itself.
What to do now
- Inventory every Adobe Campaign Classic instance, including staging and test.
- Read Adobe bulletin APSB26-142 for the fixed build and Adobe's priority rating.
- Apply the update on all servers, following Adobe's upgrade steps.
- Limit network access to Campaign Classic servers to the users and systems that need it.
- Review database and server logs for activity you cannot explain, since the record involves database and internal resource access.
Why it matters
The weakness is CWE-918, server-side request forgery. The Adobe text in the record is brief and gives no further detail. The score comes from the vector: network access, low complexity, no privileges and a changed scope.
Of the three Campaign Classic records in this bulletin, this one has the lowest barrier, because the vector lists no privileges. The record is not listed in CISA's KEV catalog and I found no report of exploitation.
Quick check
Why patch this before the other two Campaign records?
Its vector lists no privileges required, so the attacker needs the least. All three are in one bulletin, so patch together.
Sources
Last reviewed: 19 October 2026.
