CVE-2026-27302: Adobe Campaign Classic RCE Vulnerability

CVE-2026-27302 Overview

CVE-2026-27302 is an Incorrect Authorization vulnerability [CWE-863] affecting Adobe Campaign Classic (ACC). The flaw allows an unauthenticated remote attacker to execute arbitrary code in the context of the current user. Exploitation requires no user interaction and crosses a security scope boundary, giving the attacker impact beyond the vulnerable component. The issue carries a maximum CVSS 3.1 base score of 10.0. Adobe published the fix in Security Advisory APSB26-123.

Critical Impact
Unauthenticated attackers can execute arbitrary code across a changed scope, compromising confidentiality, integrity, and availability of Adobe Campaign Classic deployments.

Affected Products

Adobe Campaign Classic (ACC)
Refer to Adobe Security Advisory APSB26-123 for affected version ranges
Deployments exposing ACC endpoints to untrusted networks

Discovery Timeline

2026-08-11 - CVE-2026-27302 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-27302

Vulnerability Analysis

The vulnerability originates from an authorization control failure in Adobe Campaign Classic. The application evaluates access decisions without correctly enforcing the identity or privileges of the requester. An attacker who reaches an exposed ACC endpoint bypasses these checks and triggers code paths that should be restricted. Because the scope changes during exploitation, the attacker gains influence over resources outside the initial vulnerable component. The resulting arbitrary code execution runs in the security context of the current user, which in ACC deployments frequently includes application service accounts with access to marketing data, subscriber lists, and connected downstream systems.

Root Cause

The root cause is Incorrect Authorization [CWE-863]. The application performs an authorization check but reaches an incorrect decision, allowing an actor to invoke privileged functionality. Missing or misconfigured server-side enforcement lets requests reach code execution primitives without validated caller identity.

Attack Vector

The attack vector is network-based with low complexity. No privileges and no user interaction are required. An attacker sends a crafted request to an exposed ACC service and reaches the vulnerable authorization path, which routes into functionality that executes attacker-controlled logic. Public proof-of-concept code is not currently reported, and EPSS estimates a 0.573% probability of exploitation in the next 30 days at publication time.

No verified exploit code is publicly available for CVE-2026-27302. Refer to the Adobe Security Advisory APSB26-123 for vendor-supplied technical details.

Detection Methods for CVE-2026-27302

Indicators of Compromise

Unexpected child processes spawned by Adobe Campaign Classic service accounts, such as shells, scripting engines, or reconnaissance binaries.
Outbound network connections from ACC hosts to unfamiliar destinations, especially immediately following inbound requests to campaign endpoints.
New or modified files under ACC application directories, including scripts, workflows, or JavaScript activities added outside change-control windows.
Authentication or session anomalies where privileged ACC operations execute without a corresponding valid user session.

Detection Strategies

Correlate inbound HTTP requests to ACC endpoints with process creation events on the same host to identify request-triggered command execution.
Alert on ACC service accounts launching interpreters (cmd.exe, powershell.exe, /bin/sh, node, wscript) that are not part of documented workflows.
Baseline outbound traffic from ACC servers and flag deviations to non-corporate infrastructure.

Monitoring Recommendations

Enable verbose HTTP and application logging on ACC front-end and workflow servers, and forward logs to a centralized SIEM.
Monitor changes to ACC workflow definitions, JavaScript activities, and delivery templates for unauthorized modifications.
Track privileged operations initiated without a preceding successful authentication event.

How to Mitigate CVE-2026-27302

Immediate Actions Required

Apply the updates referenced in Adobe Security Advisory APSB26-123 to all Adobe Campaign Classic instances.
Restrict network reachability of ACC administrative and API endpoints to trusted management networks and VPN users.
Rotate credentials, API keys, and integration secrets used by ACC service accounts after patching if compromise is suspected.
Review ACC workflow definitions and JavaScript activities for unauthorized changes introduced before the patch was applied.

Patch Information

Adobe has published fixed builds through Security Advisory APSB26-123. Administrators should identify their deployment version, consult the advisory for the corresponding patched build, and apply it following Adobe's documented upgrade procedure. See Adobe Security Advisory APSB26-123 for version-specific guidance.

Workarounds

Place ACC endpoints behind a reverse proxy or web application firewall that enforces authentication before requests reach the application.
Reduce privileges of the ACC service account to the minimum required, limiting the impact of code execution in its context.
Segment ACC servers from sensitive internal systems to contain lateral movement following exploitation.