EUVD-2026-22657
GHSA-vhf9-597v-53mq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
4DescriptionCVE.org
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
AnalysisAI
Reflected cross-site scripting (XSS) in Adobe Connect 2025.3, 12.10, and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a crafted URL, potentially compromising user session data and performing actions on behalf of the victim. The vulnerability affects multiple versions across a wide product scope and requires user interaction (clicking a malicious link) to trigger. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
This vulnerability is a classic reflected XSS flaw (CWE-79) in the Adobe Connect web application, a collaborative communication platform. The vulnerability occurs because user-supplied input from URL parameters is rendered into the HTML response without proper sanitization or output encoding. Adobe Connect is a multi-user web-based platform handling sensitive meeting and collaboration data; XSS flaws in such applications are particularly dangerous because they operate within the authenticated session context of the victim, allowing an attacker to bypass normal access controls. The reflected (non-persistent) nature means the malicious payload must be embedded in the URL itself, limiting the attack surface compared to stored XSS but still enabling targeted phishing campaigns.
RemediationAI
Upgrade Adobe Connect to a patched version released after 12.10 and 2025.3. Consult Adobe's security bulletin APSB26-37 at https://helpx.adobe.com/security/products/connect/apsb26-37.html for the exact fixed version and availability timeline. As a temporary mitigation pending patching, restrict URL sharing from untrusted sources, educate users not to click suspicious links referencing Adobe Connect URLs, and consider implementing content security policy (CSP) headers to restrict inline script execution if feasible within your infrastructure.
More in Adobe Connect
View allArbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserializati
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary c
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attac
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim bro
Reflected XSS in Adobe Connect 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers th
Reflected XSS in Adobe Connect versions 12.10 and earlier enables attackers to execute malicious JavaScript in victim br
Cross-site scripting (XSS) in Adobe Connect versions 12.10 and earlier, including the 2025.3 release line, enables privi
Reflected Cross-Site Scripting in Adobe Connect versions 12.10 and earlier allows unauthenticated remote attackers to ex
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today