EUVD-2026-22669Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
AnalysisAI
Reflected Cross-Site Scripting in Adobe Connect versions 12.10 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by distributing a malicious URL. The vulnerability requires user interaction (clicking a link) and can affect the confidentiality and integrity of user sessions across different origins due to changed scope. No public exploit code or active exploitation has been confirmed at this time.
Technical ContextAI
Adobe Connect is a web-based collaboration platform built on HTTP/HTTPS. The vulnerability is a classic reflected XSS (CWE-79) where unsanitized user input is reflected in the HTTP response without proper output encoding. The 'S:C' (Scope Changed) indicator in the CVSS vector means the vulnerability can cross trust boundaries-JavaScript executed in the context of a user's Adobe Connect session can access resources or influence behavior in a different security domain. The vulnerability affects all versions of Adobe Connect through 12.10, indicating insufficient input validation or output encoding in one or more web pages served by the application. CPE cpe:2.3:a:adobe:adobe_connect identifies the product family across all vulnerable versions.
RemediationAI
Upgrade Adobe Connect to a patched version released after 12.10. Consult Adobe's official security advisory APSB26-37 (https://helpx.adobe.com/security/products/connect/apsb26-37.html) for the exact patched version number and deployment instructions. Interim mitigation measures include: enforcing HTTPS-only connections to Adobe Connect to protect against man-in-the-middle attacks; implementing Content Security Policy (CSP) headers to restrict inline JavaScript execution; educating users about phishing and suspicious links, particularly those referencing Adobe Connect; and monitoring server logs for anomalous query parameters or encoded payloads in URLs. Apply patches to all Connect instances as soon as the vendor-released patched version is available.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today