EUVD-2026-84782
GHSA-47j8-2w7r-v9hf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable low-complexity stored XSS, but persisting a payload realistically needs a low-privileged authenticated submitter (PR:L); victim must view the page (UI:R), with scope-changed browser-context C:L/I:L only.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
AnalysisAI
Stored cross-site scripting in Adobe Connect (server/web) and the Adobe Connect Android mobile app allows an attacker to plant persistent malicious JavaScript in vulnerable form fields, which then executes in a victim's browser when they view the page rendering that field. The vendor's vector rates it unauthenticated (PR:N), but our assessment holds that a practical attacker needs an account or role permitted to submit content into those fields, and the victim must actively browse to the affected page (UI:R). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions grounded in the description and vector: (1) an attacker able to inject a persistent script into one of Adobe Connect's vulnerable form fields - for a stored XSS this practically means an account/role permitted to submit into those fields, despite the vendor's PR:N rating; and (2) a victim must actively browse to the page rendering the injected field (UI:R), so the payload does not fire autonomously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine-but-modest issue, not a top priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix referenced in Adobe's advisory APSB26-150 (https://helpx.adobe.com/security/products/connect/apsb26-150.html) for both the Adobe Connect server/web product and the Adobe Connect Android mobile app; the patch reference in the available data does not state an exact fixed version, so confirm the precise build in the advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Connect
View allSQL injection in Adobe Connect lets a low-privileged authenticated user inject arbitrary SQL into a backend query, which
Arbitrary code execution in Adobe Connect - covering both the web application and the Adobe Connect Android mobile app -
Stored cross-site scripting in Adobe Connect and the Adobe Connect Android mobile app lets an attacker who can place a p
Reflected cross-site scripting (XSS) in Adobe Connect and its Android mobile app allows unauthenticated remote attackers
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malic
Stored cross-site scripting in Adobe Connect allows an attacker to inject malicious scripts into vulnerable form fields,
Arbitrary code execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) stems from insecure deserializati
Remote code execution in Adobe Connect 12.10 and earlier (including 2025.3) allows unauthenticated attackers to execute
Unauthenticated path traversal in Adobe Connect (and its Android mobile app component) lets a remote attacker read files
Remote code execution in Adobe Connect 12.10 and earlier allows unauthenticated network attackers to execute arbitrary c
Client-side arbitrary script execution in Adobe Connect (versions 2025.9.15, 2025.8.157 and earlier) lets a remote attac
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim bro
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today