EUVD-2026-22657
GHSA-vhf9-597v-53mq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
AnalysisAI
Reflected cross-site scripting (XSS) in Adobe Connect 2025.3, 12.10, and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a crafted URL, potentially compromising user session data and performing actions on behalf of the victim. The vulnerability affects multiple versions across a wide product scope and requires user interaction (clicking a malicious link) to trigger. No public exploit code or active exploitation has been confirmed at the time of analysis.
Technical ContextAI
This vulnerability is a classic reflected XSS flaw (CWE-79) in the Adobe Connect web application, a collaborative communication platform. The vulnerability occurs because user-supplied input from URL parameters is rendered into the HTML response without proper sanitization or output encoding. Adobe Connect is a multi-user web-based platform handling sensitive meeting and collaboration data; XSS flaws in such applications are particularly dangerous because they operate within the authenticated session context of the victim, allowing an attacker to bypass normal access controls. The reflected (non-persistent) nature means the malicious payload must be embedded in the URL itself, limiting the attack surface compared to stored XSS but still enabling targeted phishing campaigns.
RemediationAI
Upgrade Adobe Connect to a patched version released after 12.10 and 2025.3. Consult Adobe's security bulletin APSB26-37 at https://helpx.adobe.com/security/products/connect/apsb26-37.html for the exact fixed version and availability timeline. As a temporary mitigation pending patching, restrict URL sharing from untrusted sources, educate users not to click suspicious links referencing Adobe Connect URLs, and consider implementing content security policy (CSP) headers to restrict inline script execution if feasible within your infrastructure.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today