What is the CVSS score of CVE-2026-27245?

CVE-2026-27245 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Adobe Connect are affected by CVE-2026-27245?

Adobe Connect versions 12.10 and earlier contain a reflected cross-site scripting (XSS) vulnerability that could allow attackers to execute malicious code in user browsers and potentially access…

How to fix or mitigate CVE-2026-27245?

Within 24 hours: Inventory all Adobe Connect deployments and document current versions in use. Within 7 days: Communicate to end-users to avoid clicking suspicious links in Adobe Connect meeting invitations or emails, and educate administrators on the XSS risk vector. Within 30 days: Contact Adobe for patch availability status and timeline; in parallel, implement web application firewall (WAF) rules to detect and block reflected XSS payloads targeting Adobe Connect if feasible, and consider restricting Adobe Connect access to authenticated corporate networks only to reduce social engineering surface.

Adobe Connect CVE-2026-27245

EUVD-2026-22662 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 adobe

GHSA-px9p-mm95-78ww

XSS Adobe Adobe Connect

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 28, 2026 - 03:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 19:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:39 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 18:01 euvd

EUVD-2026-22662

Analysis Generated

Apr 14, 2026 - 18:01 vuln.today

CVE Published

Apr 14, 2026 - 17:33 nvd

CRITICAL 9.3

DescriptionNVD

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

AnalysisAI

Reflected XSS in Adobe Connect 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers through crafted URLs. The changed scope (S:C) indicates potential escape from Adobe Connect's application context to access other origins, elevating impact beyond typical reflected XSS. CVSS 9.3 reflects high confidentiality/integrity impact with scope change, though real-world exploitation requires social engineering (UI:R). EPSS score of 0.10% (27th percentile) and SSVC classification of non-automatable with no observed exploitation suggest this is lower priority than CVSS alone indicates, despite the high numerical score.

Technical ContextAI

This is a reflected (non-persistent) Cross-Site Scripting vulnerability (CWE-79) in Adobe Connect, a web conferencing platform used for virtual meetings, eLearning, and webinars. The affected product (cpe:2.3:a:adobe:adobe_connect) spans versions up to and including 12.10 and 2025.3. Reflected XSS occurs when user-supplied input is immediately returned by a web application without proper sanitization, allowing attackers to inject malicious scripts into HTTP requests. The CVSS scope change indicator (S:C) is notable for XSS vulnerabilities-it suggests the malicious JavaScript can affect resources beyond the vulnerable application's security context, potentially accessing sensitive data from other Adobe services or browser-stored credentials if the victim is authenticated to multiple Adobe properties.

RemediationAI

Adobe has released security updates addressing this vulnerability in APSB26-37. Consult the official advisory at https://helpx.adobe.com/security/products/connect/apsb26-37.html for exact patched versions and upgrade instructions specific to your deployment model (on-premises vs. hosted). As interim mitigation before patching, implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in URL parameters, though this provides incomplete protection against novel encoding techniques and may generate false positives on legitimate special characters in meeting URLs or usernames. Deploy Content Security Policy (CSP) headers with strict script-src directives to limit inline JavaScript execution-this substantially reduces XSS impact but may break legacy Adobe Connect features that rely on inline scripts, requiring testing before production deployment. For high-risk deployments, restrict Adobe Connect access to authenticated internal networks via VPN until patching is complete, trading external accessibility for elimination of the network attack vector; this is only viable for organizations not requiring external participant access to meetings.