CVE-2026-27245

CVE-2026-27245 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Adobe Connect versions 2025.3, 12.10 and earlier. An attacker could exploit this flaw by crafting a malicious URL that, when visited by a victim, executes arbitrary JavaScript code within the victim's browser context. The vulnerability has a changed scope, potentially affecting resources beyond the vulnerable component. The vulnerability carries a CVSS 3.1 score of 9.3 (CRITICAL), with a network-based attack vector requiring minimal complexity and no privileges, though user interaction is required. The attack has high impact on confidentiality and integrity, with a changed scope that could compromise the security of the entire system. The relatively low EPSS score of 0.00104 indicates limited prevalence compared to other CVEs, though the potential impact remains severe. There is no evidence of active exploitation at this time, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no activity on public exploit tracking lists. However, organizations should prioritize patching given the critical severity rating and ease of exploitation via social engineering tactics.