Adobe Connect CVE-2026-27246

Exploitation requires that victims are actively using Adobe Connect (logged in or with valid session cookies) and visit an attacker-crafted URL or webpage containing malicious DOM manipulation code. The vulnerability is in Adobe Connect versions 12.10 and earlier including the 2025.3 branch. User interaction (UI:R in CVSS vector) is mandatory - passive browsing is insufficient; the victim must click a link or load attacker-controlled content. Exploitation does NOT require the attacker to have Adobe Connect credentials (PR:N), making this accessible to external unauthenticated attackers. The changed scope (S:C) indicates exploitation is not limited to the specific vulnerable DOM component but can affect other Connect security domains, lowering exploitation barriers once initial user interaction occurs. No specific non-default Connect configuration is required - default installations are vulnerable.

Despite the critical CVSS score of 9.3, multiple signals suggest moderate real-world urgency. The CVSS vector shows network-accessible exploitation with no authentication required (AV:N/PR:N) but mandatory user interaction (UI:R) - victims must click a malicious link or visit an attacker-controlled page. The changed scope (S:C) elevates severity by enabling cross-session or cross-feature attacks within Connect's ecosystem. However, SSVC framework marks this as 'Automatable: no' due to the UI requirement, reducing worm-like propagation risk. EPSS score of 0.10% (27th percentile) indicates security researchers assess exploitation probability as low, with no confirmed public exploit code or CISA KEV listing. The combination of high CVSS but low EPSS and no exploitation evidence suggests this is a defense-in-depth fix rather than an imminent mass-exploitation risk. Prioritize patching for Connect instances handling sensitive meetings or in regulated industries, but this does not require emergency weekend patching for most organizations.

An attacker crafts a malicious URL or webpage containing manipulated DOM elements targeting Adobe Connect's JavaScript execution context. The attacker sends this link to authenticated Connect users via phishing email or posts it on a trusted forum where Connect users congregate. When a victim clicks the link while logged into Adobe Connect, the browser processes the attacker-controlled DOM manipulation, executing malicious JavaScript within the Connect application's security context. The changed scope (S:C) allows the attacker's script to access session tokens, meeting credentials, or sensitive data across Connect's features beyond the initially vulnerable component. No public proof-of-concept code is identified at time of analysis.