Adobe Connect Patches Reflected XSS Flaws Allowing Script Execution via Crafted URLs
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Apr 14, 2026
Adobe disclosed two high-severity reflected cross-site scripting vulnerabilities in Adobe Connect—CVE-2026-27245 and CVE-2026-27243—affecting versions 2025.3, 12.10, and earlier. The flaws allow an attacker to trigger execution of malicious JavaScript in a victim’s browser if the victim is persuaded to open a specially crafted URL pointing to a vulnerable page.
Both issues are classified as CWE-79 and carry the same CVSS v3.1 vector, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, indicating network-reachable exploitation with no privileges required but user interaction needed. Adobe referenced the vulnerabilities in security bulletin APSB26-37, and the changed scope plus high confidentiality and integrity impact suggest successful exploitation could let attackers act within the victim’s browser session and compromise exposed application data or actions.
