This CVE is a maximum-severity authorization bypass that breaks the security boundary between Adobe Campaign Classic's marketing configuration layer and its underlying execution environment. The CVSS 10 rating with 'Scope: Changed' is the tell — this isn't a privilege-escalation within a sandbox; it's a structural failure that affects everything ACC can touch, which in practice means your PII database, email infrastructure, and potentially the broader network ACC communicates with.
The immediate priority is patching, but understand what you're actually dealing with. ACC's architecture typically runs with database and filesystem privileges required for its marketing operations — the system must query customer data, write campaign logs, and manage attachments. Any authorization bypass in this context is effectively full compromise. There's no meaningful isolation between the 'marketing' layer and the 'system' layer to fall back on.
Your compensating controls need to assume this architectural reality. Segment ACC into its own network zone with strict egress controls — if an attacker exploits this, you want to limit what they can reach. Run ACC's service account with the minimum privileges actually required for operations, recognizing that marketing platforms accumulate technical debt in the form of deprecated-but-retained code paths that still execute authorization decisions. Audit your ACC instance for customizations, third-party connectors, and workflow modifications that create authorization paths Adobe never audited.
The patching timeline for ACC will likely be slower than standard CVEs. These patches break marketing workflows, require regression testing against CRM integrations, and demand coordination with teams that may lack security expertise. The EPSS score of 0.00639 is misleading comfort — ACC deployments are often internet-facing by design, and the authentication requirement that likely keeps EPSS low assumes your authentication is robust. If you're running default credentials or weak SAML configuration, you're already exposed.
Beyond patching this specific CVE, treat this as a signal to audit ACC's authorization boundaries holistically. Authorization flaws in marketing platforms follow documented patterns — consolidation refactors that flatten permission checks, convenience changes that remove guards, legacy code paths that remain after workflow engine upgrades. Find the siblings and offspring of this vulnerability before attackers do.