Critical XSS Hits Adobe Connect: Patch Now!

The National Vulnerability Database has issued a critical alert for Adobe Connect, detailing a reflected Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-27245. This flaw, present in Adobe Connect versions 2025.3, 12.10, and earlier, carries a whopping CVSS score of 9.3, putting it squarely in the ‘critical’ severity bracket. For those running these versions, it’s a ‘drop everything and patch’ situation.

Here’s the deal: an attacker could craft a malicious URL, and if a victim clicks it, arbitrary JavaScript code could execute within their browser’s context. We’re talking session hijacking, data theft, defacement – the whole nine yards, all within the trusted domain of the vulnerable Adobe Connect instance. The National Vulnerability Database points to CWE-79, a well-known weakness category for improper neutralization of input during web page generation. This isn’t some exotic zero-day; it’s a classic web app vulnerability with severe consequences.