CVE-2026-27302

CVE-2026-27302 is an incorrect authorization flaw (CWE-863) in Adobe Campaign Classic (ACC) in which access controls are not properly enforced, allowing an attacker to trigger arbitrary code execution in the context of the application's user. Per the CVSS 3.1 vector, it is exploitable over a network with no privileges required and no user interaction, and the 'scope changed' designation means the code execution escapes the vulnerable component, extending impact beyond the application itself. A successful attacker gains arbitrary code execution on the affected server with high impact to confidentiality, integrity, and availability, reflected in the maximum 10.0 base score. Any organization running an affected version of Campaign Classic — an enterprise marketing campaign management platform — is exposed; exact affected version ranges are not included in the available data and must be confirmed in Adobe's advisory. There is no known public exploit or PoC, the flaw is not in CISA KEV, EPSS estimates a roughly 0.7% probability of exploitation within 30 days (51st percentile), and Adobe shipped the fix in a batch release that also addressed two other CVSS 10.0 flaws in ColdFusion and Campaign Classic.

What to do: Update Adobe Campaign Classic to the release specified in Adobe's security advisory, prioritizing internet-exposed instances since exploitation requires no authentication or user interaction. Until patched, restrict network access to Campaign Classic application servers and monitor for anomalous process activity. Because affected version ranges are not in this dataset, verify eligibility against the advisory before scheduling the upgrade.