It sounds like you have already checked the common configuration and permission issues. The Apex 400 and Visualforce 503 may indicate a package compatibility or platform-specific issue, so I would suggest opening a support case with both Salesforce and Cybersource for further investigation.