CVE-2026-27246 is a critical (CVSS 9.3) DOM based cross site scripting flaw in Adobe Connect versions 2025.3, 12.10 and earlier. A victim must visit a crafted URL or interact with a compromised page. Apply the update named in Adobe bulletin APSB26-37.
What's affected
Adobe Connect versions 2025.3, 12.10 and earlier, per the record. The record also lists the Connect desktop application and the macOS and Windows platforms.
The record does not state fixed version numbers. Adobe's bulletin APSB26-37 is the place to confirm them, so open it and note the exact updated builds before you plan the change.
How to check if you're exposed
Check your Connect version in the administration console or with your hosting provider. If you are on 2025.3 or 12.10 or earlier, you are in the affected range named by the record.
If Adobe hosts your Connect service, ask your account contact whether the update is already applied. Self hosted installations need the patch applied by your team.
What to do now
- Open Adobe bulletin APSB26-37 and find the fixed versions for your deployment.
- Update Adobe Connect, and the desktop application if you use it, to the fixed builds.
- Tell users to avoid following unexpected links to your Connect address until the update is applied.
- Review web proxy logs for odd URLs pointing at your Connect host.
- Add Connect to your tracked inventory so future bulletins reach the right owner.
Why it matters
The class is CWE-79. In DOM based XSS the unsafe handling happens in the page's own script in the browser, not on the server, so the server logs may show nothing unusual. The record says scope is changed.
Because the flaw sits in client side code, server side filtering is a weak control, and the vendor update is the dependable fix. The record does not mark this CVE as known exploited.
Quick check
Why is DOM based XSS harder to spot in logs?
The unsafe step happens in the browser, so the server may only see an ordinary looking request.
Sources
- CVE-2026-27246 on Gold
- NVD record for CVE-2026-27246, published 14 April 2026
- Adobe security bulletin APSB26-37 listed in the record (the page refused an automated fetch, so check it directly): https://helpx.adobe.com/security/products/connect/apsb26-37.html
Last reviewed: 19 October 2026.
