Product:
Adobe Connect
Summary
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this vulnerability by convincing a victim to visit a URL that references a vulnerable page. This may allow malicious JavaScript content to be executed within the context of the victim’s browser. The scope of the attack is changed.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2026-27243 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious URL that targets a vulnerable page in Adobe Connect. The attacker then needs to convince the victim to click on this URL, which will execute the malicious JavaScript in the victim’s browser. This can lead to unauthorized actions being performed on behalf of the victim or sensitive information being exposed.
Affected Products
- Adobe Connect 2025.3: Affected by reflected XSS vulnerability allowing execution of malicious scripts.
- Adobe Connect 12.10: Vulnerable to the same reflected XSS issue as version 2025.3.
- Earlier versions: All versions prior to 2025.3 and 12.10 are also affected by this vulnerability.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of Adobe Connect that addresses the reflected XSS issue. Additionally, users should be cautious about clicking on unknown links and ensure that they are accessing trusted sources.