CVE-2026-27243

An attacker prepares a specially crafted URL or malicious website containing an XSS payload. When the victim visits such a link or interacts with the compromised site, the vulnerable Adobe Connect application reflects unverified data in the HTTP response, causing malicious script execution in the victim's browser context. Due to the changed scope, the effects may extend beyond the application itself, including resources accessible in the user's session.

An attacker can gain access to the victim's session or account, and perform actions on their behalf — potentially with elevated privileges. Session cookie theft, credential theft, or theft of other sensitive information processed in the browser is possible.

Adobe Connect should be updated to a version newer than 2025.3 / 12.10 in accordance with the manufacturer's recommendations described in security bulletin APSB26-37 available at https://helpx.adobe.com/security/products/connect/apsb26-37.html. Until the patch is deployed, it is recommended to educate users not to click on unknown or suspicious links leading to Adobe Connect instances.

Adobe Connect in versions 2025.3, 12.10 and earlier, running on Microsoft Windows and Apple macOS (including Adobe Connect Desktop Application).