EUVD-2026-22662
GHSA-px9p-mm95-78ww
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionCVE.org
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
AnalysisAI
Reflected XSS in Adobe Connect 12.10 and earlier enables attackers to execute malicious JavaScript in victim browsers through crafted URLs. The changed scope (S:C) indicates potential escape from Adobe Connect's application context to access other origins, elevating impact beyond typical reflected XSS. CVSS 9.3 reflects high confidentiality/integrity impact with scope change, though real-world exploitation requires social engineering (UI:R). EPSS score of 0.10% (27th percentile) and SSVC classification of non-automatable with no observed exploitation suggest this is lower priority than CVSS alone indicates, despite the high numerical score.
Technical ContextAI
This is a reflected (non-persistent) Cross-Site Scripting vulnerability (CWE-79) in Adobe Connect, a web conferencing platform used for virtual meetings, eLearning, and webinars. The affected product (cpe:2.3:a:adobe:adobe_connect) spans versions up to and including 12.10 and 2025.3. Reflected XSS occurs when user-supplied input is immediately returned by a web application without proper sanitization, allowing attackers to inject malicious scripts into HTTP requests. The CVSS scope change indicator (S:C) is notable for XSS vulnerabilities-it suggests the malicious JavaScript can affect resources beyond the vulnerable application's security context, potentially accessing sensitive data from other Adobe services or browser-stored credentials if the victim is authenticated to multiple Adobe properties.
RemediationAI
Adobe has released security updates addressing this vulnerability in APSB26-37. Consult the official advisory at https://helpx.adobe.com/security/products/connect/apsb26-37.html for exact patched versions and upgrade instructions specific to your deployment model (on-premises vs. hosted). As interim mitigation before patching, implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in URL parameters, though this provides incomplete protection against novel encoding techniques and may generate false positives on legitimate special characters in meeting URLs or usernames. Deploy Content Security Policy (CSP) headers with strict script-src directives to limit inline JavaScript execution-this substantially reduces XSS impact but may break legacy Adobe Connect features that rely on inline scripts, requiring testing before production deployment. For high-risk deployments, restrict Adobe Connect access to authenticated internal networks via VPN until patching is complete, trading external accessibility for elimination of the network attack vector; this is only viable for organizations not requiring external participant access to meetings.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today