CVE-2026-27245
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Wersje Adobe Connect 2025.3, 12.10 i wcześniejsze są podatne na odzwierciedloną podatność typu Cross-Site Scripting (XSS). Atakujący może wykorzystać tę podatność do wstrzykiwania złośliwych skryptów na stronę internetową, co może prowadzić do uzyskania podwyższonych uprawnień lub kontroli nad kontem ofiary lub jej sesją.
Risk Assessment
Wykorzystanie tej podatności może prowadzić do przejęcia kont użytkowników oraz dostępu do wrażliwych danych organizacji. Wymaga to interakcji użytkownika, co zwiększa ryzyko w przypadku nieświadomego kliknięcia w złośliwy link.
Recommendation
Zaleca się aktualizację Adobe Connect do najnowszej wersji, aby usunąć tę podatność. Dodatkowo, warto edukować użytkowników na temat zagrożeń związanych z klikaniem w nieznane linki.
Related vulnerabilities
- CVE-2026-107282Critical
Vulnerability in AsyncHttpClient (AHC) library before versions 3.0.13 and 2.16.1 allows cross-host request replay that updates the current request but leaves the target request and proxy context pointing to the original origin. This can send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination.
- CVE-2026-76268Critical
Vulnerability in Splunk Enterprise before versions 10.4.3 and 10.2.7 allows an unauthenticated user with network access to the Patroni REST API on a search head cluster member to execute attacker-controlled OS commands. The interface does not require authentication for critical configuration operations.
- CVE-2026-95606Critical
Deserialization of untrusted data vulnerability in The Events Calendar plugin allows object injection. Affects versions up to 6.17.4.
- CVE-2026-95605Critical
SQL injection vulnerability in WP Data Access allows blind SQL injection. Affects versions up to 5.5.82.
- CVE-2026-76501Critical
Vulnerability in SRv6 OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM and SRv6 features are enabled.
- CVE-2026-76500Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper control of a resource through its lifetime (CWE-664). These have been addressed in hardening releases.
- CVE-2026-76499Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper neutralization issues (CWE-707). These have been addressed in hardening releases.
- CVE-2026-76498Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper access control (CWE-284). These have been addressed in hardening releases.
- CVE-2026-76486Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
- CVE-2026-76485Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
Original NVD description (English source)
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS