Loading vulnerability…
Unauthenticated SSRF in Adobe Campaign Classic
CVE-2026-48331 is a server-side request forgery vulnerability in Adobe Campaign Classic v7 through 7.4.3 build 9398. An unauthenticated remote attacker can cause the Campaign Classic server to issue requests to internal services, cloud metadata endpoints, or other resources not directly reachable by the attacker. The issue requires no user interaction and has changed scope; it can result in privilege escalation and, in affected environments, may enable further compromise of the underlying server or connected services.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose or access internal network services, administrative interfaces, cloud-instance metadata, and potentially credentials available to the vulnerable server. The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H indicates network-reachable exploitation with low complexity, no privileges or user interaction, changed scope, and high confidentiality, integrity, and availability impact. Exploitation may permit privilege escalation and can contribute to arbitrary code execution in affected deployments.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting external access to Adobe Campaign Classic, especially for internet-facing and externally accessible deployments. Limit the application's ability to initiate outbound requests to internal services, cloud metadata endpoints, and administrative interfaces through network segmentation and egress filtering. Constrain access to sensitive internal resources from the application host and monitor for anomalous server-initiated requests that could indicate SSRF exploitation. These measures are compensating controls and should not replace upgrading to the fixed build.
Patch, then assume compromise.
Upgrade Adobe Campaign Classic to v7.4.3 build 9399 or a later supported fixed release. Adobe-hosted Campaign Classic instances were remediated by Adobe; on-premise and hybrid deployments require customer-applied updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.