What is the CVSS score of CVE-2026-34614?

CVE-2026-34614 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Adobe Connect CVE-2026-34614

EUVD-2026-22669 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 adobe

XSS Adobe Adobe Connect

6.1

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 19:43 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 18:01 euvd

EUVD-2026-22669

Analysis Generated

Apr 14, 2026 - 18:01 vuln.today

CVE Published

Apr 14, 2026 - 17:33 nvd

MEDIUM 6.1

DescriptionCVE.org

Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.

AnalysisAI

Reflected Cross-Site Scripting in Adobe Connect versions 12.10 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by distributing a malicious URL. The vulnerability requires user interaction (clicking a link) and can affect the confidentiality and integrity of user sessions across different origins due to changed scope. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

Adobe Connect is a web-based collaboration platform built on HTTP/HTTPS. The vulnerability is a classic reflected XSS (CWE-79) where unsanitized user input is reflected in the HTTP response without proper output encoding. The 'S:C' (Scope Changed) indicator in the CVSS vector means the vulnerability can cross trust boundaries-JavaScript executed in the context of a user's Adobe Connect session can access resources or influence behavior in a different security domain. The vulnerability affects all versions of Adobe Connect through 12.10, indicating insufficient input validation or output encoding in one or more web pages served by the application. CPE cpe:2.3:a:adobe:adobe_connect identifies the product family across all vulnerable versions.

RemediationAI

Upgrade Adobe Connect to a patched version released after 12.10. Consult Adobe's official security advisory APSB26-37 (https://helpx.adobe.com/security/products/connect/apsb26-37.html) for the exact patched version number and deployment instructions. Interim mitigation measures include: enforcing HTTPS-only connections to Adobe Connect to protect against man-in-the-middle attacks; implementing Content Security Policy (CSP) headers to restrict inline JavaScript execution; educating users about phishing and suspicious links, particularly those referencing Adobe Connect; and monitoring server logs for anomalous query parameters or encoded payloads in URLs. Apply patches to all Connect instances as soon as the vendor-released patched version is available.