A critical Server-Side Request Forgery vulnerability in Adobe Campaign Classic allows authenticated attackers to escalate privileges and compromise internal network infrastructure.

The software is susceptible to a Server-Side Request Forgery (CWE-918) vulnerability that can be triggered by a low-privileged authenticated user. This flaw enables an attacker to force the application to interact with internal resources, facilitating privilege escalation and unauthorized access to systems beyond the application boundary.

The vulnerability carries a CVSS score of 9.9, reflecting its critical potential for full system compromise. Successful exploitation allows an attacker to bypass internal network security controls, potentially leading to the exfiltration of sensitive data, unauthorized administrative actions, or the compromise of backend infrastructure. The resulting scope change significantly increases the blast radius of this vulnerability.

Immediate Action: Update Adobe Campaign Classic to build 9402 or later as documented in the vendor security advisory.

Proactive Monitoring: Review application access logs for unusual outbound requests from the Campaign Classic server to internal subnets or sensitive infrastructure endpoints.

Compensating Controls: Implement strict egress filtering on the application server to restrict network connections to only known, required destinations, effectively neutralizing the SSRF vector.

Public Exploit Available: Unknown.

Given the critical nature of this vulnerability and its potential for full system compromise, administrators must prioritize patching Adobe Campaign Classic to build 9402 immediately. Organizations unable to patch instantly should verify that network segmentation and egress controls are strictly enforced to prevent the application from communicating with unauthorized internal resources.