EUVD-2026-22661
GHSA-fm65-7j3c-jcv3
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
AnalysisAI
Reflected XSS in Adobe Connect 12.10 and earlier enables remote attackers to execute arbitrary JavaScript in victim browsers via malicious URLs. The scope-changed CVSS designation reflects potential cross-domain impact, elevating this to critical severity (9.3). …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: inventory all Adobe Connect deployments and version numbers across the organization; notify end-users to avoid clicking unfamiliar links in emails or messages referencing Adobe Connect meetings. Within 7 days: implement email gateway controls to flag or block suspicious URLs containing Adobe Connect domains; enable browser security headers (CSP, X-Frame-Options) on Adobe Connect instances if configurable. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today