The CVSS 10 score on CVE-2026-48323 tells you the technical severity but obscures the operational complexity. This is improper neutralization in Adobe Campaign's template engine, which in Java-based enterprise platforms almost certainly means unsanitized input reaching a templating layer—and yes, that yields arbitrary code execution. But the severity math misses the point. Adobe Campaign isn't a standalone web app; it's an enterprise hub with direct access to customer databases, CRM systems, and email delivery infrastructure. Scope change here means a compromised Campaign instance can pivot into connected systems that should require separate compromise.
The low EPSS of 0.00624 doesn't mean the vulnerability is safe—it likely reflects the attack surface geometry. Exploitation probably requires chaining through authenticated workflow steps rather than direct request injection. The template rendering happens in workflow execution contexts and message queues (AMQP/JMS), not in web logs you'd normally monitor. This is both a detection opportunity and an explanation for why mass exploitation hasn't materialized: the surface requires CRM data imports and workflow triggers, not an open endpoint.
Your containment priority should be: audit what database write privileges Campaign holds beyond campaign-specific databases, review integration service accounts for unnecessary cross-domain trust, and implement output validation at the templating layer rather than relying on input sanitization alone.
One critical wrinkle: if you're on Adobe's hosted infrastructure, you likely cannot independently verify your patch status—you're dependent on Adobe's communications and may lack access to workflow logs or message queues where exploitation would leave traces. The organizations most exposed may be the ones least able to investigate. Assume heterogeneity in patch state across the customer base until Adobe confirms otherwise.