Adobe Campaign Classic versions 7.4.3 build 9394 and earlier are vulnerable to a Server‑Side Request Forgery (SSRF) flaw that can be exploited without any user interaction. The weakness allows an attacker to instruct the application to make arbitrary HTTP requests to internal or external resources, potentially exposing sensitive data or facilitating a privilege escalation scenario. The vulnerability is identified as CWE‑918 and is rated with a CVSS of 10, indicating a critical level of risk.

Adobe Campaign Classic (ACC) users running any build of version 7.4.3 or earlier are impacted. These builds should be upgraded to the latest patch level released by Adobe, which addresses the SSRF condition and associated privilege escalation.

The exploit requires no user action and leverages the application's outbound request capability, making remote exploitation straightforward for attackers with network access to the ACC instance. With a CVSS score of 10, the flaw is considered critical; the EPSS score is currently unavailable, so the probability of exploitation in the wild is unknown but cannot be assumed low. Adobe does not list this vulnerability in the CISA KEV catalog, yet its high severity warrants immediate remediation.