CVE-2021-21009: Adobe Campaign

High severity, CVSS 8.6. EPSS: 3% chance of exploitation in the next 30 days.

Adobe Campaign Classic Gold Standard 10 (and earlier), 20.3.1 (and earlier), 20.2.3 (and earlier), 20.1.3 (and earlier), 19.2.3 (and earlier) and 19.1.7 (and earlier) are affected by a server-side request forgery (SSRF) vulnerability. Successful exploitation could allow an attacker to use the Campaign instance to issue unauthorized requests to internal or external resources.

Affected products

• Adobe Campaign: before 19.1.8 (fixed in 19.1.8); from 19.2, before 19.2.4 (fixed in 19.2.4); from 20.1, before 20.1.4 (fixed in 20.1.4); from 20.2, before 20.2.4 (fixed in 20.2.4); from 20.3, before 20.3.3 (fixed in 20.3.3)

Published 2021-01-13. Last modified 2026-08-24.