Adobe Connect Flaws Expose Users to XSS and Potential Code Execution
Vulnerability Disclosure · 3 sources · Updated 4mo ago · First seen Apr 14, 2026
Adobe disclosed two high-severity vulnerabilities in Adobe Connect affecting versions 2025.3, 12.10, and earlier, and directed customers to advisory APSB26-37 for remediation. One issue, CVE-2026-27246, is a DOM-based cross-site scripting flaw classified as CWE-79 that can let an attacker manipulate the browser DOM and run malicious JavaScript in a victim’s session after luring the user to a crafted webpage. The vulnerability carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, indicating network reachability, low attack complexity, no privileges required, and high confidentiality and integrity impact.
Adobe also disclosed CVE-2026-34615, a CWE-502 deserialization of untrusted data vulnerability in the same product versions that can lead to arbitrary code execution in the context of the current user. Adobe said exploitation of the deserialization flaw does not require user interaction, making it the more serious of the two issues, while both bugs were published through Adobe’s PSIRT process and affect the same supported and earlier Adobe Connect releases. Organizations using Adobe Connect should prioritize patching exposed deployments and reviewing the vendor advisory for fixed versions and mitigation guidance.
