What is the CVSS score of CVE-2026-27243?

CVE-2026-27243 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Adobe Connect are affected by CVE-2026-27243?

Adobe Connect versions 12.10 and earlier contain a critical reflected cross-site scripting (XSS) vulnerability (CVSS 9.3) that allows unauthenticated attackers to execute arbitrary JavaScript in user…

How to fix or mitigate CVE-2026-27243?

Within 24 hours: Inventory all Adobe Connect deployments and identify which are internet-accessible; notify users of the vulnerability and advise against clicking unknown links to Connect instances. Within 7 days: Upgrade Adobe Connect to version 12.11 or later (when released by vendor); if unavailable, implement network-level access restrictions (WAF rules, IP allowlisting, or VPN-only access) to limit exposure surface. Within 30 days: Conduct post-patch validation and verify all instances run patched versions; review access logs for suspicious URL patterns indicative of exploitation attempts.

Adobe Connect CVE-2026-27243

EUVD-2026-22661 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 adobe

GHSA-fm65-7j3c-jcv3

XSS Adobe Adobe Connect

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 28, 2026 - 03:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 19:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:38 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 18:01 euvd

EUVD-2026-22661

Analysis Generated

Apr 14, 2026 - 18:01 vuln.today

CVE Published

Apr 14, 2026 - 17:33 nvd

CRITICAL 9.3

DescriptionNVD

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

AnalysisAI

Reflected XSS in Adobe Connect versions 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers through crafted URLs. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component, elevating the severity to 9.3 despite being 'just' XSS. Requires user interaction (clicking malicious link) but no authentication. EPSS score of 0.10% (27th percentile) suggests low probability of mass exploitation. CISA SSVC framework rates this as non-automatable with total technical impact but no observed exploitation, indicating priority for patch deployment in internet-facing Adobe Connect deployments but not emergency response level.

Technical ContextAI

Adobe Connect is a web conferencing and virtual classroom platform. This vulnerability stems from improper neutralization of input during web page generation (CWE-79), where user-supplied data in URL parameters is reflected into HTML responses without adequate sanitization or output encoding. The CPE string cpe:2.3:a:adobe:adobe_connect:*:*:*:*:*:*:*:* with version constraint ≤12.10 indicates all Connect versions through 12.10 are affected. The changed scope metric (S:C) is noteworthy for XSS vulnerabilities, suggesting the JavaScript execution context can escape the vulnerable component's security boundaries-possibly accessing session tokens for other Adobe services, parent domain cookies, or cross-origin resources through misconfigurations. This elevates impact beyond typical reflected XSS where scope remains unchanged.

RemediationAI

Apply Adobe's security update per bulletin APSB26-37 available at https://helpx.adobe.com/security/products/connect/apsb26-37.html. The advisory should specify the patched version superseding 12.10; upgrade to that release immediately for internet-facing deployments. If immediate patching is not feasible, implement compensating controls: deploy web application firewall (WAF) rules to sanitize URL parameters and block JavaScript event handlers in query strings (trade-off: may break legitimate deep-linking features); enforce Content Security Policy headers with strict script-src directives to prevent inline JavaScript execution (trade-off: requires testing to ensure meeting functionality is not disrupted); and educate users not to click Connect meeting links from untrusted sources or unexpected emails. For high-security environments, restrict Connect access to known IP ranges or VPN-only access until patching is complete.