CVE-2026-27243 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Adobe Connect versions 2025.3, 12.10 and earlier. The vulnerability allows attackers to inject malicious scripts that execute in the context of a victim's browser session, potentially leading to elevated privileges or session hijacking. Exploitation requires the victim to interact with a crafted URL or compromised web content. The vulnerability changes the security scope and has a CVSS 3.1 base score of 9.3, indicating critical impact on confidentiality and integrity. No vendor-provided patch or remediation level is currently documented.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser session, potentially resulting in elevated access or control over the victim's Adobe Connect account or session. This can compromise confidentiality and integrity of user data. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when clicking on links or interacting with untrusted content related to Adobe Connect. Monitor Adobe's official channels for updates and apply patches promptly once available.