CVE-2026-27243

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-27243
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

9.3 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://helpx.adobe.com/security/products/connect/apsb26-37.html Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:*
OR cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:*
cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:windows:*:*
History

28 Apr 2026, 03:16

Type Values Removed Values Added
Summary (en) Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed. (en) Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

22 Apr 2026, 19:35

Type Values Removed Values Added
CPE cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:*
cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:windows:*:*
cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
First Time Adobe connect
Adobe
Microsoft windows
Adobe connect Desktop Application
Microsoft
Apple macos
Apple
References () https://helpx.adobe.com/security/products/connect/apsb26-37.html - () https://helpx.adobe.com/security/products/connect/apsb26-37.html - Vendor Advisory

14 Apr 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-14 18:16

Updated : 2026-04-28 15:39

NVD link : CVE-2026-27243

Mitre link : CVE-2026-27243

CVE.ORG link : CVE-2026-27243

JSON object : View

Products Affected

adobe

  • connect_desktop_application
  • connect

microsoft

  • windows

apple

  • macos
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')