CVE-2026-27243 is a critical (CVSS 9.3) reflected cross site scripting flaw in Adobe Connect versions 2025.3, 12.10 and earlier. A victim has to follow a crafted URL or interact with a compromised page. Apply the update named in Adobe bulletin APSB26-37.
What's affected
Adobe Connect versions 2025.3, 12.10 and earlier, per the record. The record also lists the Connect desktop application and the macOS and Windows platforms.
The record does not state fixed version numbers. Adobe's bulletin APSB26-37 is the place to confirm them, so open it and note the exact updated builds before you plan the change.
How to check if you're exposed
Check your Connect version in the administration console or with your hosting provider. If you are on 2025.3 or 12.10 or earlier, you are in the affected range named by the record.
If Adobe hosts your Connect service, ask your account contact whether the update is already applied. Self hosted installations need the patch applied by your team.
What to do now
- Open Adobe bulletin APSB26-37 and find the fixed versions for your deployment.
- Update Adobe Connect, and the desktop application if you use it, to the fixed builds.
- Tell users to avoid following unexpected links to your Connect address until the update is applied.
- Review web proxy logs for odd URLs pointing at your Connect host.
- Add Connect to your tracked inventory so future bulletins reach the right owner.
Why it matters
The weakness is CWE-79, cross site scripting. A reflected flaw echoes part of a request back in the page without encoding it, so a crafted link can run script in the victim's session. The record says scope is changed, which is why the score is high even though user interaction is needed.
For a web conferencing platform, a hijacked session can expose meetings and account data. The record does not mark this CVE as known exploited.
Quick check
Does the victim need to do anything?
Yes. The record says a victim must visit a crafted URL or interact with a compromised page.
Sources
- CVE-2026-27243 on Gold
- NVD record for CVE-2026-27243, published 14 April 2026
- Adobe security bulletin APSB26-37 listed in the record (the page refused an automated fetch, so check it directly): https://helpx.adobe.com/security/products/connect/apsb26-37.html
Last reviewed: 19 October 2026.
