CVE-2026-75684

Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

At a glance

Severity
CRITICAL 9.3
EPSS
EPSS 0.74 % · percentile 55 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
adobe
NVD status
Analyzed

Description

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

Scores

VersionScoreVectorScored by
CVSS 3.1CRITICAL 9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:Nadobe
CVSS 3.1CRITICAL 9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NNVD · psirt@adobe.com (Secondary)

Weaknesses (CWE)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
Adobe · Adobe Connectaffected 0 ≤ 12.11 ; unaffected 12.11.1, 12.12
Adobe · Adobe Connect Android Mobile Appaffected 0 ≤ 4.4 ; unaffected 4.5

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD