What is the CVSS score of CVE-2026-27246?

CVE-2026-27246 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Adobe Connect are affected by CVE-2026-27246?

Adobe Connect versions 12.10 and earlier contain a DOM-based cross-site scripting vulnerability that could allow attackers to execute malicious code in users' browsers and potentially compromise…

How to fix or mitigate CVE-2026-27246?

Within 24 hours: Inventory all Adobe Connect deployments and versions currently in use; notify stakeholders of the vulnerability. Within 7 days: Apply Adobe patch APSB26-37 to all affected systems running version 12.10 or earlier, prioritizing production environments; validate patch installation. Within 30 days: Conduct post-patch security testing; implement user awareness training on not clicking suspicious links; review access logs for anomalous activity.

Adobe Connect CVE-2026-27246

EUVD-2026-22663 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 adobe

GHSA-4c2f-hvf5-4jwv

XSS Adobe Adobe Connect

9.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 28, 2026 - 03:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 22, 2026 - 19:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:39 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 18:01 euvd

EUVD-2026-22663

Analysis Generated

Apr 14, 2026 - 18:01 vuln.today

CVE Published

Apr 14, 2026 - 17:33 nvd

CRITICAL 9.3

DescriptionNVD

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

AnalysisAI

DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim browsers when users visit attacker-crafted webpages. The changed scope in CVSS vector (S:C) indicates the vulnerability can affect resources beyond the vulnerable component's security authority, potentially allowing lateral access to other Connect features or sessions. Adobe has released a patch in APSB26-37. EPSS exploitation probability is low (0.10%, 27th percentile) with no confirmed active exploitation (not in CISA KEV), suggesting this is currently a theoretical risk rather than an imminent mass-exploitation threat.

Technical ContextAI

DOM-based XSS (CWE-79) occurs when Adobe Connect's client-side JavaScript code improperly processes user-controllable data within the Document Object Model without adequate sanitization. Unlike reflected or stored XSS where the server sends malicious content, DOM-based XSS executes entirely in the browser via unsafe DOM manipulation (e.g., innerHTML, document.write, eval) of attacker-controlled sources like URL fragments or postMessage events. The affected CPE (cpe:2.3:a:adobe:adobe_connect:*:*:*:*:*:*:*:*) covers all Adobe Connect versions through 12.10, including the 2025.3 release branch. Adobe Connect is a web conferencing platform handling sensitive meeting data, user sessions, and organizational content, making XSS particularly dangerous for session hijacking and data exfiltration across the platform's security boundary.

RemediationAI

Apply the vendor-released patch detailed in Adobe Security Bulletin APSB26-37 (https://helpx.adobe.com/security/products/connect/apsb26-37.html). The advisory specifies the exact patched version to upgrade to - administrators should consult APSB26-37 for the fixed release number and upgrade procedures specific to their deployment model (on-premises vs hosted). If immediate patching is not feasible, implement compensating controls: configure Content Security Policy headers to restrict script sources to trusted domains only (add 'script-src self' directive; note this may break third-party integrations requiring whitelisting), deploy web application firewall rules to detect and block JavaScript event handlers in URL parameters (high false-positive risk with legitimate Connect workflows), and educate users not to click untrusted links while authenticated to Connect (weakest control, relies on user behavior). These workarounds reduce but do not eliminate risk since DOM-based XSS executes client-side beyond server-side filtering.