CVE-2026-27302

CVE-2026-27302 is an Incorrect Authorization vulnerability in Adobe Campaign Classic with CVSS 10.0 and 'Scope: Changed' — meaning a lower-privilege operator can exceed their authorized boundaries. The EPSS score is modest, but this disconnect reflects the specialized knowledge required to exploit it, not genuine difficulty. The blast radius of a successful exploit is substantial: a compromised session in ACC typically has access to workflow execution, database queries, operator management, and integration credentials for downstream CRM and marketing systems — exploitation doesn't stop at the ACC boundary. The vulnerability almost certainly lives in one of Adobe Campaign's high-privilege execution contexts — server-side JavaScript (JSSP), workflow activities, or SOAP/REST API endpoints that execute with server authority rather than propagating the caller's operator permissions. This isn't a single logic error; it's a systemic failure where the platform's extensibility model creates execution contexts that were historically assumed to run in trusted internal operator contexts. When these contexts are exposed to lower-privilege operators through new features or integrations, authorization breaks. For defenders, the practical implication is that patching this specific CVE won't prevent the next structurally identical flaw. Audit your ACC environment for all JSSP endpoints, workflow activity entry points, and custom API surfaces where operator permission propagation may be inconsistent. The most dangerous code paths are often the oldest — predating modern authorization review and surviving simply because they're 'not new code' and therefore not flagged for security review. The gap between 'this flaw class exists' and 'all instances hardened' is measured in years, not days. Prioritize auditing undocumented hooks, configuration-driven execution contexts, and workflow activities added during past consulting engagements — these are the forgotten surfaces where authorization hygiene has rotted.

Reviewed through automated stages and approved by a human before publication.