What is the CVSS score of CVE-2026-47938?

CVE-2026-47938 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Adobe Campaign Classic are affected by CVE-2026-47938?

Adobe Campaign Classic versions 7.4.3 build 9394 and earlier face critical unauthenticated remote code execution via server-side request forgery (CVSS 10.0).

How to fix or mitigate CVE-2026-47938?

Within 24 hours: Inventory all Adobe Campaign Classic instances and immediately restrict network access to trusted corporate networks using firewall rules; enable application logging. Within 7 days: Deploy Web Application Firewall rules to block SSRF payloads; implement network segmentation isolating ACC from backend services and databases; conduct credential audit of ACC service accounts. Within 30 days: Monitor Adobe advisory APSB26-66 weekly for patch release; upon availability, test patch in non-production environment and deploy to all ACC 7.4.3 build 9394 and earlier instances; validate exploitation indicators have been cleared from logs.

Adobe Campaign Classic CVE-2026-47938

EUVD-2026-35839 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-09 psirt@adobe.com

GHSA-6m7j-3j3g-22g4

Adobe SSRF RCE

10.0

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 21:33 vuln.today

CVE Published

Jun 09, 2026 - 21:17 nvd

CRITICAL 10.0

DescriptionCVE.org

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

Articles & Coverage 2

News 19 New Adobe Vulnerabilities - 3 Critical, 16 High Severity Jun 10, 2026 News Critical SSRF to RCE in Adobe Campaign Classic 7.4.3 - CVE-2026-47938 Jun 09, 2026

AnalysisAI

Server-side request forgery in Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier escalates to arbitrary code execution in the context of the current user, with a maximum CVSS 10.0 reflecting unauthenticated network exploitation and scope change. No public exploit identified at time of analysis, but the vendor advisory APSB26-66 confirms the flaw and the trivial attack complexity (AC:L) combined with PR:N and UI:N makes ACC instances reachable from untrusted networks an urgent patch target. The scope change (S:C) indicates the SSRF pivots beyond the originating component, enabling reach into adjacent backend services typically isolated from external callers.

Technical ContextAI

Adobe Campaign Classic is Adobe's on-premise/hosted cross-channel marketing automation platform, which exposes web-facing application servers that orchestrate campaign delivery, integrate with internal data sources, and call out to external services. The root cause is CWE-918 (Server-Side Request Forgery): the server fetches a URL whose destination is influenced by attacker-controlled input without sufficient validation of the target host, scheme, or port. Because ACC servers commonly sit inside trusted enterprise network segments with access to internal HTTP endpoints, cloud metadata services, and authenticated backend APIs, an SSRF primitive in this product can be coerced into issuing privileged internal requests, retrieving secrets, or - as the advisory states - chaining into arbitrary code execution in the context of the running user.

RemediationAI

Patch available per vendor advisory: upgrade Adobe Campaign Classic to the fixed build published in APSB26-66 (https://helpx.adobe.com/security/products/campaign/apsb26-66.html) - the advisory page is the authoritative source for the exact post-9394 patched build number, which was not included in the input data and should not be assumed. Until the upgrade is deployed, restrict network reachability of ACC application servers so that only trusted operator networks can reach the HTTP listener (block direct internet exposure at the WAF/edge), and egress-filter the ACC servers themselves to deny outbound requests to internal RFC1918 ranges, cloud metadata endpoints (169.254.169.254), and any backend services the platform does not legitimately need to call - accepting that overly tight egress rules may break legitimate integrations such as REST connectors, webhook delivery, and email-provider callouts, so test in staging first. Monitor ACC web logs for anomalous outbound URL parameters and unusual internal-target responses as a detection compensating control.