CVE-2026-27245

The vulnerability lies in insufficient filtering of input data returned by the application in the HTTP response, which allows malicious JavaScript code to be embedded in the page content. The attacker prepares a specially crafted URL or compromised website and tricks the victim into visiting or interacting with it. When the user clicks, the malicious script executes in the victim's browser within the context of the trusted Adobe Connect domain. The changed scope indicates that the effects of script execution may extend beyond the application in which the vulnerability originally occurred.

An attacker can gain unauthorized access to the victim's account or active session, including stealing authentication tokens (e.g., session cookies), and perform actions on behalf of the logged-in user. Potential consequences include privilege escalation and complete account takeover in the Adobe Connect application.

Adobe Connect should be updated to a version higher than 2025.3 / 12.10, applying patches available from the vendor according to the security bulletin: https://helpx.adobe.com/security/products/connect/apsb26-37.html. Until the update is applied, it is recommended to implement WAF (Web Application Firewall) rules limiting the ability to pass malicious parameters, and users should exercise particular caution when clicking links leading to the Adobe Connect platform.

Adobe Connect version 2025.3, 12.10 and all earlier versions, running on Microsoft Windows and Apple macOS platforms (including the Adobe Connect Desktop Application).