CVE-2026-27243: Adobe Connect reflected cross-site scripting (XSS)
Adobe Connect and the Adobe Connect Desktop Application are affected by a reflected cross-site scripting flaw classified as CWE-79. NVD assigns a critical base score of 9.3 with a changed scope, and exploitation requires user interaction. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.
Overview
Adobe Connect and its desktop application are affected by a reflected cross-site scripting (XSS) flaw classified as CWE-79. The vendor advisory APSB26-37 is the primary reference in the record.
Impact
- The description states that an attacker could inject malicious scripts into a web page and potentially gain elevated access or control over a victim's account or session.
- The NVD base score is 9.3 (critical), with high confidentiality and integrity impact, no availability impact, and a changed scope.
- User interaction is required: the victim must visit a crafted URL or interact with a compromised page.
Affected products and versions
- Adobe Connect: before 12.11 and up to and including 12.10.
- Adobe Connect Desktop Application: up to and including 2025.3 and before 2025.9.15.
The record does not list fixed builds. The upper limits 12.11 and 2025.9.15 appear as range boundaries, and administrators should confirm the exact remediated builds in the vendor advisory.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. SSVC marks exploitation as none and automatable as no. The EPSS probability is 0.00744 (percentile 0.54273) as recorded. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Identify all Adobe Connect servers and Desktop Application installations and compare them with the affected ranges above.
- Apply the update described in the vendor advisory as soon as possible, given the critical score and the scope change.
- Until patching is complete, limit exposure of affected instances, reinforce user awareness about links from untrusted sources, and review web-layer protections such as output encoding and content security policy where the deployment allows.
Detection guidance
- Review web and application logs for requests with unusual or script-like content in parameters, especially those arriving from external referrers.
- Watch for unexpected session activity or account changes that follow user clicks on external links.
- Use email and web filtering to flag links pointing to Adobe Connect hosts that are not recognized.
Limitations of the available information
The record does not identify the vulnerable parameter, the exact fixed builds, or the deployment conditions required. The EPSS date in the record is later than the publication date, so the scoring snapshot should be treated with caution. This analysis relies only on the record and the cited references.
Frequently asked questions
Which Adobe Connect versions are affected by CVE-2026-27243?
The record lists Adobe Connect before 12.11 and up to and including 12.10, and Adobe Connect Desktop Application up to and including 2025.3 and before 2025.9.15.
Is this vulnerability known to be exploited in the wild?
The record does not list this CVE in CISA KEV, and SSVC marks exploitation as none. No confirmed exploitation appears in the sources consulted.
Does the attack require user interaction?
Yes. The description states that a victim must visit a maliciously crafted URL or interact with a compromised web page.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.