Adobe Connect EUVD-2026-22673

Adobe Connect versions 2025.3, 12.10 and earlier. Requires low-privilege authenticated attacker account. Victim must click malicious URL or visit compromised web page in their browser session. Scope change enables privilege escalation.

Real-world risk is moderate-to-high despite the 8.7 CVSS score. The attack vector is network-based with low complexity (AV:N/AC:L), enabling remote exploitation, but mandatory user interaction (UI:R) creates a significant barrier requiring social engineering success. The changed scope (S:C) and high confidentiality/integrity impact (C:H/I:H) elevate concern for multi-tenant environments where privilege escalation could compromise administrative functions or multiple user sessions. EPSS probability not available in provided data, limiting automated risk quantification. No CISA KEV listing and no public exploit code suggest this is not yet actively weaponized, but Adobe's security bulletin publication makes this exploitable by moderately skilled attackers. SSVC framework considerations: exploitation status is public (CVE disclosed), automatable is 'no' (requires user interaction), technical impact is total (privilege escalation with changed scope). Priority should be high for organizations using Adobe Connect in shared hosting or multi-tenant configurations, moderate for isolated deployments with limited user bases.

A low-privileged authenticated Adobe Connect user crafts a malicious URL containing JavaScript payloads targeting session cookies or authentication tokens. The attacker shares this URL through Adobe Connect's chat, shared notes, or meeting invitation features, enticing a meeting host or administrator to click. When the victim accesses the URL within their authenticated Adobe Connect session, the injected script executes with the victim's privileges, exfiltrating session credentials or performing administrative actions such as modifying user permissions, accessing confidential meeting recordings, or injecting persistent backdoors into shared content repositories accessible across the changed scope boundary.