Loading vulnerability…
SSRF leading to arbitrary code execution in Adobe Campaign Classic
CVE-2026-76193 is a server-side request forgery vulnerability in Adobe Campaign Classic v7 version 7.4.4 build 9400 and earlier. It allows an unauthenticated remote attacker to induce unauthorized server-side requests and may result in arbitrary code execution in the context of the current user, without user interaction. Affected environments include Windows and Linux on-premises installations and on-premises components of hybrid deployments. The specific vulnerable function and request format are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may execute arbitrary code with the privileges of the current user and compromise the confidentiality, integrity, and availability of the affected Campaign Classic instance. Attacker-controlled server-side requests may also reach restricted internal or external services and facilitate data exfiltration. Execution with elevated privileges is not established.
If you can’t patch tonight, do this now.
Until the update is deployed, restrict access to Campaign Classic interfaces to trusted users and networks, minimize application and service-account privileges, and segment Campaign Classic servers from sensitive internal services. Monitor for unexpected outbound connections and abnormal process execution. These measures reduce exposure and potential impact but do not replace the security update.
Patch, then assume compromise.
Upgrade affected Adobe Campaign Classic v7 installations to version 7.4.4 build 9401 or later using the security update associated with Adobe bulletin APSB26-134. Verify that all affected Windows and Linux installations, including on-premises components of hybrid deployments, have been updated. Adobe-hosted instances have already been remediated and require no customer action.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.