Security readout for executives and security teams
Plain-English summary
A malicious link or compromised webpage could make an affected Adobe Connect client run attacker-controlled script. If a user interacts with it, the attacker may gain substantial access to the user’s account or session. The issue is critical because no prior account access is required, although successful exploitation depends on victim interaction.
Executive priority
Treat this as an urgent remediation item for organizations using Adobe Connect, especially externally accessible deployments. Prioritize accurate inventory, vendor-guided updating, and user communication. Escalate to incident response if unusual session or account activity is detected.
Technical view
This is a network-reachable DOM-based cross-site scripting vulnerability classified as CWE-79. It requires no privileges but does require user interaction. The CVSS 3.1 score is 9.3, with changed scope and high confidentiality and integrity impact; availability impact is not identified.
Likely exposure
Potential exposure includes Adobe Connect 12.10 and earlier and the 2025.3 release line and earlier. However, the structured affected data also lists 12.11 and 2025.9 boundaries. Organizations should reconcile installed product variants and versions against Adobe advisory APSB26-37 before concluding exposure.
Exploitation context
The provided record does not identify active exploitation, and the KEV flag is false. Exploitation requires a victim to visit a crafted URL or interact with a compromised webpage. No authentication or prior privileges are required according to the CVSS vector.
Researcher notes
The supplied narrative and structured affected-version fields are not fully aligned: the narrative names 2025.3 and 12.10 and earlier, while structured boundaries include 2025.9 and 12.11. Confirm exact ranges through APSB26-37. No public exploitation evidence, technical root-cause detail, or named indicators of compromise are provided.
Mitigation direction
- Review Adobe advisory APSB26-37 for confirmed fixed releases and apply its update guidance promptly.
- Inventory Adobe Connect server and desktop application versions across managed and unmanaged endpoints.
- Warn users to avoid unexpected Adobe Connect links until affected installations are remediated.
- Consider invalidating active sessions after remediation where account or session compromise is suspected.
Validation and detection
- Compare every installed version and product variant with the applicability details in APSB26-37.
- Confirm the Adobe-recommended update is installed on servers and managed desktop clients.
- Review relevant security telemetry for suspicious Connect links, unexpected session activity, or account changes.
- Verify previously authenticated sessions are handled according to the organization’s incident-response decision.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27246 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N2.85.8adobeVulnerability scoring details
Base CVSS 3.1 score
9.3CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://helpx.adobe.com/security/products/connect/apsb26-37.htmlCVE reference, adobe · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.