EUVD-2026-22662
GHSA-px9p-mm95-78ww
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
AnalysisAI
Reflected Cross-Site Scripting in Adobe Connect 12.10 and earlier allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers via crafted URLs, with scope change enabling attacks beyond the vulnerable application's security context. CVSS 9.3 severity driven by network-based attack vector requiring no privileges, changed scope allowing cross-domain impact, and high confidentiality/integrity compromise. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all instances of Adobe Connect 12.10 and earlier in production and document current version inventory. Within 7 days: Implement network-level controls restricting Adobe Connect access to known internal IP ranges and require multi-factor authentication for all user sessions; monitor for suspicious URLs and failed session activity. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today