Loading vulnerability…
Reflected XSS in Adobe Connect
CVE-2026-27243 is a reflected cross-site scripting vulnerability in Adobe Connect affecting versions 2025.3, 12.10, and earlier. The flaw allows attacker-controlled input to be reflected by a vulnerable page and executed as malicious JavaScript in the victim's browser when the victim visits a crafted link or otherwise interacts with attacker-supplied web content. The issue is exploitable over the network, requires no prior authentication, and has changed scope because script execution occurs within the victim's browser context and can affect the victim's authenticated session with the application.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in execution of arbitrary script in the context of the victim's Adobe Connect session. This can enable theft or misuse of session data, unauthorized actions performed as the victim, access to sensitive information exposed to that user, and modification of data or application state available through the victim's privileges. The available scoring information indicates high confidentiality and integrity impact, with no direct availability impact.
If you can’t patch tonight, do this now.
No separate vendor workaround is identified. Until patches are applied, reduce exposure by limiting delivery of untrusted links to users, enforcing strong output encoding and input validation in custom integrations or adjacent components where applicable, and using browser-side controls such as Content Security Policy to reduce script execution risk. User awareness measures to avoid opening unsolicited crafted links can also reduce exploitability, but patching is the primary mitigation.
Patch, then assume compromise.
Upgrade Adobe Connect to a fixed release later than version 12.10, and apply the vendor security update associated with APSB26-37. Affected deployments running version 2025.3, 12.10, or earlier should be updated promptly to the vendor-provided corrected version.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.