CVE-2026-27245
Published: 14 April 2026
Summary
CVE-2026-27245 is a critical-severity Cross-site Scripting (CWE-79) vulnerability in Adobe Connect Desktop Application. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-27245 is a reflected Cross-Site Scripting (XSS) vulnerability, classified under CWE-79, affecting Adobe Connect versions 2025.3, 12.10, and earlier. Assigned a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), it enables attackers to inject malicious scripts into web pages served by the affected software. The vulnerability was published on 2026-04-14 and involves a changed scope, indicating potential cross-origin effects.
Attackers with network access can exploit this issue without privileges by crafting malicious URLs or compromising web pages that trick victims into interacting with them, such as clicking links or visiting sites. Successful exploitation requires user interaction but allows injected scripts to execute in the victim's browser context, potentially granting attackers elevated access or control over the victim's Adobe Connect account or session, with high impacts on confidentiality and integrity.
For mitigation details, refer to Adobe's security bulletin at https://helpx.adobe.com/security/products/connect/apsb26-37.html, which provides guidance on patches and remediation for affected versions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22662
Vulnerability details
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account…
more
or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Reflected XSS in public-facing Adobe Connect directly enables exploitation of public-facing applications (T1190), stealing web session cookies (T1539), and browser session hijacking (T1185) via arbitrary JavaScript execution in victim browsers.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the reflected XSS flaw in Adobe Connect by requiring timely application of vendor patches as specified in the security bulletin.
Filters information output from web pages to block execution of injected malicious scripts in the victim's browser context.
Validates untrusted inputs from malicious URLs to prevent injection of script payloads into Adobe Connect web responses.