EUVD-2026-22663
GHSA-4c2f-hvf5-4jwv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionCVE.org
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
AnalysisAI
DOM-based XSS in Adobe Connect 12.10 and earlier (including 2025.3) enables malicious JavaScript execution in victim browsers when users visit attacker-crafted webpages. The changed scope in CVSS vector (S:C) indicates the vulnerability can affect resources beyond the vulnerable component's security authority, potentially allowing lateral access to other Connect features or sessions. Adobe has released a patch in APSB26-37. EPSS exploitation probability is low (0.10%, 27th percentile) with no confirmed active exploitation (not in CISA KEV), suggesting this is currently a theoretical risk rather than an imminent mass-exploitation threat.
Technical ContextAI
DOM-based XSS (CWE-79) occurs when Adobe Connect's client-side JavaScript code improperly processes user-controllable data within the Document Object Model without adequate sanitization. Unlike reflected or stored XSS where the server sends malicious content, DOM-based XSS executes entirely in the browser via unsafe DOM manipulation (e.g., innerHTML, document.write, eval) of attacker-controlled sources like URL fragments or postMessage events. The affected CPE (cpe:2.3:a:adobe:adobe_connect:*:*:*:*:*:*:*:*) covers all Adobe Connect versions through 12.10, including the 2025.3 release branch. Adobe Connect is a web conferencing platform handling sensitive meeting data, user sessions, and organizational content, making XSS particularly dangerous for session hijacking and data exfiltration across the platform's security boundary.
RemediationAI
Apply the vendor-released patch detailed in Adobe Security Bulletin APSB26-37 (https://helpx.adobe.com/security/products/connect/apsb26-37.html). The advisory specifies the exact patched version to upgrade to - administrators should consult APSB26-37 for the fixed release number and upgrade procedures specific to their deployment model (on-premises vs hosted). If immediate patching is not feasible, implement compensating controls: configure Content Security Policy headers to restrict script sources to trusted domains only (add 'script-src self' directive; note this may break third-party integrations requiring whitelisting), deploy web application firewall rules to detect and block JavaScript event handlers in URL parameters (high false-positive risk with legitimate Connect workflows), and educate users not to click untrusted links while authenticated to Connect (weakest control, relies on user behavior). These workarounds reduce but do not eliminate risk since DOM-based XSS executes client-side beyond server-side filtering.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today