CVE-2026-82443

CriticalCVSS 9.9/10Last modified Sep 23, 2026

Description

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Sep 22, 2026
Last modified: Sep 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-824478.8Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja CVE-2026-824489.8Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execut CVE-2026-824495.3Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password v CVE-2026-82455.4Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection. Concrete\Core\Legacy\Paginati CVE-2026-824508.8BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Impo CVE-2026-824516.1Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped CVE-2026-824529.8rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication gua CVE-2026-824537.5rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API respo CVE-2026-824549.1The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The CVE-2026-8245610.0argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGO CVE-2026-824577.8su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing tr CVE-2026-824588.7Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd,