Loading vulnerability…
DOM-based XSS in Adobe Connect
CVE-2026-27246 is a DOM-based cross-site scripting vulnerability affecting Adobe Connect versions 2025.3, 12.10, and earlier. The flaw allows attacker-controlled input to influence client-side DOM processing in a way that can cause malicious JavaScript to execute within the victim’s browser context. Successful exploitation requires user interaction, specifically that a victim visit a maliciously crafted URL or interact with a crafted or compromised web page. The vulnerability is classified with changed scope, indicating that exploitation in the browser context can impact resources beyond the vulnerable component’s original security boundary, such as the user’s authenticated application session.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in execution of attacker-supplied script in the context of the victim’s Adobe Connect session in the browser. This can enable theft or misuse of session context, unauthorized actions performed as the victim, access to sensitive information exposed to the session, and modification of application data or workflow visible to the user. Reported scoring indicates high confidentiality and integrity impact, with no direct availability impact.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting delivery of untrusted links to users, enforcing user awareness around suspicious URLs and embedded content, and using browser-side controls such as strong content security policy and script restriction mechanisms where operationally feasible. Because exploitation requires user interaction with crafted web content, reducing opportunities for users to open attacker-controlled pages can lower risk until the product is updated. No vendor-provided workaround is noted in the available information.
Patch, then assume compromise.
Upgrade Adobe Connect to a fixed release later than version 12.10. Affected versions include 2025.3, 12.10, and earlier. Apply the vendor security update referenced for Adobe Connect to remediate the vulnerable client-side behavior.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.