Product:
Adobe Connect
Summary
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim’s browser. Exploitation requires user interaction as a victim must visit a crafted webpage.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2026-27246 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious webpage that manipulates the DOM environment of the victim’s browser. The attacker then needs to trick the victim into visiting this webpage, which will execute the malicious JavaScript in the context of the victim’s session, potentially leading to unauthorized actions or data exposure.
Affected Products
- Adobe Connect 2025.3: Affected by a critical XSS vulnerability requiring user interaction.
- Adobe Connect 12.10: Vulnerable to DOM-based XSS, allowing execution of malicious scripts.
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of Adobe Connect and apply any available security updates. Additionally, users should be cautious when clicking on links or visiting webpages from untrusted sources to avoid potential exploitation.