Adobe Campaign Classic — SSRF to cloud metadata endpoint (CVE-2026-48331)

Ankit Mehta@Secvyn

•updated Aug 5, 2026•15•0•25

This rule detects attempts to access cloud instance metadata services (specifically Google Cloud's metadata service) initiated by processes commonly associated with Adobe Campaign Classic (nlserver or w3wp.exe). Such requests are often indicative of Server-Side Request Forgery (SSRF) attempts, where an attacker leverages an application-level vulnerability to probe internal cloud infrastructure for sensitive data or credentials.