CVE-2026-47938 Overview
CVE-2026-47938 is a Server-Side Request Forgery (SSRF) vulnerability affecting Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier. The flaw allows unauthenticated attackers to coerce the server into issuing crafted requests, leading to privilege escalation. Exploitation requires no user interaction and changes scope, meaning the impact extends beyond the vulnerable component. Adobe published advisory APSB26-66 to address the issue. The vulnerability is categorized under [CWE-918] Server-Side Request Forgery.
Critical Impact
An unauthenticated network attacker can trigger SSRF in Adobe Campaign Classic to escalate privileges and reach internal resources outside the application's intended trust boundary.
Affected Products
- Adobe Campaign Classic (ACC) version 7.4.3 build 9394
- Adobe Campaign Classic (ACC) versions prior to 7.4.3 build 9394
- Adobe Campaign Classic v7 deployments running affected builds
Discovery Timeline
- 2026-06-09 - CVE-2026-47938 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-47938
Vulnerability Analysis
The vulnerability resides in Adobe Campaign Classic, a cross-channel marketing automation platform used by enterprises for campaign management and customer data orchestration. An attacker submits a crafted request to a vulnerable ACC endpoint. The server then processes attacker-controlled URLs or hostnames without adequate validation. As a result, the server issues outbound requests to arbitrary destinations chosen by the attacker.
Because scope is changed, the SSRF can reach resources beyond the original application's security boundary. This includes internal services, cloud metadata endpoints, and adjacent infrastructure. The combination of unauthenticated access and scope change enables privilege escalation across trust zones.
Root Cause
The root cause is insufficient validation of user-supplied URLs or request parameters processed by server-side request logic. The application accepts attacker-controlled input and uses it to construct outbound HTTP requests. Missing allowlisting, hostname resolution checks, and response filtering allow the attacker to redirect requests to internal or restricted destinations.
Attack Vector
The attack vector is network-based with low complexity and no required privileges or user interaction. An attacker sends a single crafted HTTP request to an exposed Adobe Campaign Classic instance. The vulnerable endpoint parses the request, follows attacker-supplied URLs, and returns responses or executes actions in privileged contexts. This is documented in the Adobe Security Advisory APSB26-66.
No public proof-of-concept exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-47938
Indicators of Compromise
- Outbound HTTP/HTTPS requests originating from Adobe Campaign Classic servers to internal IP ranges, link-local addresses (169.254.169.254), or unexpected external hosts
- Anomalous request parameters in ACC web traffic containing full URLs, IP addresses, or hostnames in fields not normally expecting them
- Unexpected authentication or session activity following requests to ACC endpoints that process external resources
Detection Strategies
- Monitor web server and application logs for unusual URL patterns submitted to Adobe Campaign Classic endpoints
- Inspect egress traffic from ACC hosts for connections to cloud metadata services, RFC 1918 addresses, or non-business destinations
- Correlate ACC outbound requests with privileged actions or configuration changes to identify SSRF-driven escalation chains
Monitoring Recommendations
- Enable verbose request logging on ACC application servers and forward to a centralized analytics platform
- Deploy network egress filtering and alert on deviations from baseline destinations for ACC server traffic
- Track authentication events and administrative changes on systems reachable from ACC infrastructure
How to Mitigate CVE-2026-47938
Immediate Actions Required
- Apply the security update referenced in Adobe Security Advisory APSB26-66 to all Adobe Campaign Classic v7 instances
- Inventory all ACC deployments and confirm build numbers against the affected list (7.4.3 build 9394 and earlier)
- Restrict network egress from ACC application servers to a defined allowlist of business-required destinations
- Block ACC server access to internal management networks and cloud metadata endpoints at the firewall layer
Patch Information
Adobe released fixes addressed in Adobe Security Advisory APSB26-66. Administrators should upgrade Adobe Campaign Classic to the fixed build identified in the advisory and validate the patch level after deployment.
Workarounds
- Place ACC behind a reverse proxy or web application firewall configured to inspect and reject requests containing URL or IP parameters targeting internal ranges
- Apply strict network segmentation so that ACC servers cannot initiate connections to sensitive internal services
- Disable or restrict any ACC features that fetch external resources if business requirements permit until patching is complete
# Example egress restriction using iptables to block ACC access to metadata and internal ranges
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
