Loading vulnerability…
Reflected XSS in Adobe Connect
CVE-2026-27245 is a reflected cross-site scripting vulnerability affecting Adobe Connect versions 2025.3, 12.10, and earlier. The flaw allows attacker-controlled input to be reflected by a vulnerable page and executed as malicious JavaScript in the victim's browser when the victim visits a crafted link or otherwise interacts with attacker-controlled web content. The issue is unauthenticated and network-reachable, but exploitation requires user interaction. Because the script executes in the security context of the targeted Adobe Connect application within the victim's browser, the vulnerability can affect confidentiality and integrity of data accessible through that session, and the scope is changed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can cause arbitrary script execution in the victim's browser in the context of Adobe Connect. This can enable theft or misuse of session context, unauthorized actions performed as the victim, access to sensitive information exposed to that session, and manipulation of application content or workflow visible to the user. The published CVSS v3.1 vector indicates high confidentiality and integrity impact, no direct availability impact, and changed scope.
If you can’t patch tonight, do this now.
No separate vendor workaround is identified. Until patching is completed, reduce exposure by limiting access to Adobe Connect interfaces where feasible and warning users not to open untrusted or unsolicited links targeting the application. Standard browser-side controls and content handling restrictions may reduce exploit reliability but do not replace vendor remediation.
Patch, then assume compromise.
Upgrade Adobe Connect to a fixed release later than version 12.10, as directed by Adobe's April 2026 security updates. Affected deployments running version 2025.3, 12.10, or earlier should be updated to the vendor-provided patched version to eliminate the reflected XSS condition.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.