CVE-2026-27246

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27246", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-02-18T22:02:41.383Z", "datePublished": "2026-04-14T17:33:47.834Z", "dateUpdated": "2026-08-27T22:15:59.482Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Adobe Connect", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "12.10", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "12.11", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Adobe Connect Desktop Application", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2025.3", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2025.9", "versionType": "custom"}]}], "datePublic": "2026-04-14T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 9.3, "environmentalSeverity": "CRITICAL", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "NETWORK", "modifiedAvailabilityImpact": "NONE", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "CHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "CHANGED", "temporalScore": 9.3, "temporalSeverity": "CRITICAL", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Cross-site Scripting (DOM-based XSS) (CWE-79)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:15:59.482Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/connect/apsb26-37.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T17:53:11.006380Z", "id": "CVE-2026-27246", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T17:55:44.469Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27246", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-14T17:53:11.006380Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T17:55:40.225Z"}}], "cna": {"title": "Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "modifiedScope": "CHANGED", "temporalScore": 9.3, "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "CRITICAL", "availabilityImpact": "NONE", "environmentalScore": 9.3, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "confidentialityImpact": "HIGH", "environmentalSeverity": "CRITICAL", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "HIGH", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "Adobe Connect", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "12.10"}, {"status": "unaffected", "version": "12.11", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "Adobe Connect Desktop Application", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2025.3"}, {"status": "unaffected", "version": "2025.9", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-14T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/connect/apsb26-37.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross-site Scripting (DOM-based XSS) (CWE-79)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:15:59.482Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27246", "state": "PUBLISHED", "dateUpdated": "2026-08-27T22:15:59.482Z", "dateReserved": "2026-02-18T22:02:41.383Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-04-14T17:33:47.834Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Adobe Connect", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "12.10", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "12.11", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Adobe Connect Desktop Application", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2025.3", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2025.9", "versionType": "custom"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:connect:*:*:*:*:*:-:*:*", "matchCriteriaId": "4A1D88E9-612C-49B1-8521-F2258D4D74CA", "versionEndExcluding": "12.11", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:macos:*:*", "matchCriteriaId": "185BF6E9-82FC-45E0-A64E-03FB923F34AD", "versionEndIncluding": "2025.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:connect_desktop_application:*:*:*:*:*:windows:*:*", "matchCriteriaId": "783AAAA9-E68B-43E3-86A3-5227E27392A5", "versionEndExcluding": "2025.9.15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed."}, {"lang": "es", "value": "Las versiones 2025.3, 12.10 y anteriores de Adobe Connect est\u00e1n afectadas por una vulnerabilidad de cross-site scripting (XSS) basada en DOM. Un atacante podr\u00eda explotar este problema manipulando el entorno DOM para ejecutar JavaScript malicioso dentro del contexto del navegador de la v\u00edctima. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario, en el sentido de que la v\u00edctima debe visitar una p\u00e1gina web dise\u00f1ada espec\u00edficamente. El alcance ha cambiado."}], "id": "CVE-2026-27246", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.8, "source": "psirt@adobe.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27246", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T17:53:11.006380Z", "version": "2.0.3"}}]}, "published": "2026-04-14T18:16:56.050", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/connect/apsb26-37.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,12.10]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "adobe_connect", "vendor": "adobe"}], "analysis": {"en": {"generated_at": "2026-04-28T21:35:19.888020+00:00", "value": {"mitigation_remediation": ["Assess the current Adobe Connect deployment to confirm if it is running a vulnerable version", "Download and apply the latest official patch or upgrade to a version newer than 2025.3 or 12.10 from Adobe\u2019s website", "Conduct functional regression testing to verify that critical features continue to work after the patch or upgrade"], "summary": {"action": "Patch Now", "impact": "Cross\u2011Site Scripting (DOM\u2011based XSS)"}, "threat_synthesis": {"affected_systems": "The affected product is Adobe Connect. Deployments running version 2025.3, 12.10, or any earlier release are vulnerable. Administrators should inventory their installations, verify the deployed version, and plan to upgrade to a patch\u2011provided release as soon as possible.", "description_and_impact": "Adobe Connect versions 2025.3, 12.10 and earlier contain a DOM\u2011based Cross\u2011Site Scripting flaw that allows an attacker to inject malicious JavaScript into a page. The vulnerability is triggered when a user visits a crafted URL or interacts with a compromised web page, and by exploiting it an attacker can gain elevated access or control over the victim\u2019s account or session. This is a CWE\u201179 type flaw that can be used to hijack the browser context, steal session data, or perform other malicious actions. The flaw also changes the scope of the application code, potentially expanding the attack surface for the adversary.", "risk_and_exploitability": "The CVSS score of 9.3 indicates a high severity. Exploitation requires user interaction, which somewhat limits spontaneous attacks, but a successful event can lead to serious confidentiality or integrity compromise. The EPSS score is < 1%, indicating a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, yet the elevated severity and potential for widespread impact justify immediate remediation."}}}}, "created": "2026-04-15T14:41:09.780053+00:00", "updated": "2026-04-28T21:45:26.139051+00:00", "vendors": ["adobe", "adobe$PRODUCT$adobe_connect"]}