CVE Intelligence
Analysis AI-assisted

CVE-2026-27245: Adobe Connect - Reflected Cross-site Scripting (XSS)

Adobe Connect and the Adobe Connect Desktop Application are affected by a reflected Cross-site Scripting (XSS) vulnerability classified as CWE-79. The record rates it critical with an NVD base score of 9.3 and says exploitation requires user interaction. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Adobe Connect and the Adobe Connect Desktop Application are affected by a reflected Cross-site Scripting (XSS) issue classified as CWE-79. According to the record, injected scripts could run in a victim's context and potentially give elevated access or control over the victim's account or session. The record states that a victim must visit a crafted URL or interact with a compromised page, and that the scope is changed.

Impact

  • The NVD base score in the record is 9.3, and the severity is listed as critical.
  • The vector in the record describes a network attack with low complexity, no privileges required, user interaction required, changed scope, high confidentiality impact, high integrity impact and no availability impact.
  • The practical impact depends on what the victim's session can access inside Adobe Connect, which the record does not detail.

Affected products and versions

  • Adobe Connect: before 12.11 and up to and including 12.10.
  • Adobe Connect Desktop Application: up to and including 2025.3 and before 2025.9.15.

The record lists no fixed versions. The upper limits of the ranges suggest that 12.11 and 2025.9.15 are the first versions outside the affected ranges, but this is an inference that must be confirmed in the vendor advisory.

Exploitation status

  • The record shows no CISA KEV listing, so no active exploitation is confirmed by that source.
  • The SSVC record shows exploitation as none and automatable as no.
  • The EPSS probability in the record is 0.00744.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the vendor advisory APSB26-37 and identify the fixed release for your deployment.
  • Upgrade Adobe Connect and the Adobe Connect Desktop Application to a version outside the affected ranges, as specified by the vendor.
  • Until patching is complete, limit exposure of Adobe Connect instances and warn users to avoid unexpected links and untrusted pages.
  • Review session and account security practices, such as timely logout and monitoring of unusual account activity.

Detection guidance

  • Review web server and application logs for unusual or encoded content in request parameters directed at Adobe Connect.
  • Monitor for user reports of unexpected prompts, redirects or page behaviour after opening links.
  • Check for unexpected account or session activity that could follow a successful client-side attack.

Limitations of the available information

  • The record does not list fixed versions, so the patched release must be confirmed in the vendor advisory.
  • The record does not describe the vulnerable parameter, the specific page or the exact conditions of exploitation.
  • Only the references listed in the record were consulted; the advisory text itself was not reviewed.
  • The EPSS date in the record should be verified against the EPSS source before use.

Frequently asked questions

Is CVE-2026-27245 known to be actively exploited?

The record does not list the CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value in the record is none.

Which Adobe Connect versions are affected?

Adobe Connect is affected before 12.11 and up to and including 12.10. The Adobe Connect Desktop Application is affected up to and including 2025.3 and before 2025.9.15.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.