CVE-2026-47938

Awaiting Analysis Awaiting Analysis - Queue

Adobe Campaign Classic Server-Side Request Forgery Vulnerability

Publication date: 2026-06-09

Last updated on: 2026-06-09

Assigner: Adobe Systems Incorporated

Description

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-09

Last Modified

2026-06-09

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-28

NVD

CVE-2026-47938

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	campaign_classic	to 7.4.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) issue found in Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier. It allows an attacker to make the server perform unauthorized requests, which can lead to arbitrary code execution within the context of the current user. Notably, exploiting this vulnerability does not require any user interaction.

Impact Analysis

The impact of this vulnerability is severe. An attacker can execute arbitrary code on the affected system without needing any user interaction, potentially gaining control over the system or accessing sensitive data. The vulnerability has a maximum CVSS base score of 10.0, indicating critical severity with high impact on confidentiality, integrity, and availability.

Compliance Impact

The vulnerability in Adobe Campaign Classic (ACC) is a Server-Side Request Forgery (SSRF) that can lead to privilege escalation without user interaction, with a critical CVSS score of 10.0. Such a vulnerability could potentially allow unauthorized access to sensitive data or systems, which may impact compliance with data protection regulations like GDPR and HIPAA that require strict controls over data confidentiality, integrity, and access.

However, there is no specific information provided about the direct impact of this vulnerability on compliance with these standards or regulations.

Hi! I’m here to help you understand CVE-2026-47938. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70