CVE-2026-27302 is an Incorrect Authorization vulnerability in Adobe Campaign Classic that enables an attacker to execute arbitrary code in the context of the current user. The vulnerability does not require user interaction and changes the security scope, indicating a significant impact on confidentiality, integrity, and availability. The CVSS 3.1 base score is 10.0, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided at this time.

Successful exploitation could lead to arbitrary code execution with the privileges of the current user, potentially compromising system confidentiality, integrity, and availability. The vulnerability can be exploited remotely without user interaction, increasing the risk of widespread impact. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to Adobe Campaign Classic installations and monitor for suspicious activity related to unauthorized code execution attempts.