CVE-2026-27245 is a reflected Cross-Site Scripting (CWE-79) vulnerability affecting Adobe Connect versions 2025.3, 12.10 and earlier. An attacker can exploit this flaw by tricking a user into visiting a malicious URL or interacting with a compromised web page, causing malicious scripts to execute in the context of the victim's browser session. This can lead to elevated access or control over the victim's account or session. The vulnerability has a CVSS 3.1 base score of 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, changed scope, and high impact on confidentiality and integrity. No patch or official remediation level has been published by Adobe as of the data provided.

Successful exploitation can result in an attacker executing arbitrary scripts in the context of the victim's browser session, potentially leading to account compromise or session hijacking. The vulnerability impacts confidentiality and integrity with no impact on availability. The critical CVSS score reflects the high potential impact if exploited. However, exploitation requires user interaction, limiting automated exploitation. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when clicking on links or interacting with untrusted content related to Adobe Connect. Monitor Adobe's security advisories for updates on patches or mitigations. No vendor-provided temporary fixes or workarounds are currently documented.