EUVD-2026-22661
GHSA-fm65-7j3c-jcv3
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionNVD
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
AnalysisAI
Reflected XSS in Adobe Connect versions 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers through crafted URLs. The changed scope (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable component, elevating the severity to 9.3 despite being 'just' XSS. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Adobe Connect deployments and identify which are internet-accessible; notify users of the vulnerability and advise against clicking unknown links to Connect instances. Within 7 days: Upgrade Adobe Connect to version 12.11 or later (when released by vendor); if unavailable, implement network-level access restrictions (WAF rules, IP allowlisting, or VPN-only access) to limit exposure surface. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today