EUVD-2026-84780
GHSA-phhr-w55x-mr2c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Storing the payload requires authoring access (PR:L) and victim page-visit (UI:R); stored XSS crosses the browser trust boundary (S:C) with limited session-scoped C:L/I:L, not full C:H/I:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
3DescriptionCVE.org
Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malicious JavaScript inside a vulnerable form field, which then executes in the browser of any user who later browses to the page rendering that field - enabling session or account takeover inside the victim's browser context. Adobe rates the flaw 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent analysis assesses it more conservatively as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because the injection step realistically requires prior authenticated content-submission or authoring access and a victim must still be drawn to the affected page; impact is bounded by the victim's browser session rather than direct server compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) the attacker to have access to write/store content into a vulnerable Adobe Connect form field - practically an authenticated user with content-submission or authoring privileges, not an anonymous outsider; and (2) UI:R - a victim must subsequently browse to the page that renders the stored field for the payload to execute in their browser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a vendor-reported (Adobe APSB26-150) stored XSS in Adobe Connect and its Android mobile app, scored 9.3 by Adobe with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version was specified in the available data, so treat the Adobe advisory APSB26-150 (https://helpx.adobe.com/security/products/connect/apsb26-150.html) as the authoritative source for the fixed builds and apply them to both Adobe Connect and the Android mobile app as soon as the advisory-designated versions are available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm the deployed Adobe Connect version (on-premise or hosted) and the Android app build in use, notify the IT and security teams plus meeting administrators, and issue a short advisory instructing users not to submit content into unfamiliar or untrusted Connect forms, rooms, or shared content pages; restrict content-authoring and form-submission privileges to the smallest possible set of trusted accounts, and enable heightened monitoring for anomalous session activity in Connect. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today