CVE-2026-27243

CVE-2026-27243 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Adobe Connect versions 2025.3, 12.10, and earlier. An attacker can exploit this flaw by crafting a malicious URL that, when visited by a victim, executes arbitrary JavaScript code within the victim's browser session. The vulnerability has a widened scope, potentially affecting system integrity and confidentiality. The vulnerability is rated MEDIUM severity with a CVSS score of 6.1, indicating relatively low complexity for exploitation over the network without requiring authentication. The attack requires user interaction, as a victim must be convinced to visit the attacker-controlled URL. While the impact is limited to partial disclosure of information and minor integrity changes, the changed scope means the attack can affect resources beyond the vulnerable component itself. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on security hotlists. Its exceptionally low EPSS score of 0.001 suggests minimal real-world exploitation probability, indicating this is primarily a theoretical concern at present with limited community attention.